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THE ISSUE 


Nuclear power has been a fact of life in the developed world for two generations. It is 
a workhorse supplier of base electricity loads in Ontario, France, Belgium, Japan and 
many American states. Highly publicized accidents at Chernobyl, and to a. lesser 
extent Three Mile Island, have raised public concern around the world about the safety 
of nuclear generating stations. Since the planning process which will guide the 
Province’s power generation for the next 25 years is now under way, it is important 
that the public and elected officials understand how and why these and other nuclear 
accidents occurred and whether there are lessons to be learned in designing and 


operating CANDU facilities in Ontario. 


This Current Issue Paper reviews major accidents which have occurred at commercial 
and military nuclear facilities, and provides basic background on nuclear power and 
reactor design features to assist the novice in understanding the very complex 
technical issues surrounding these events. Above ali, the role of human factors in the 


prevention of potential accident situations is emphasized. 


Legislative Research Service 
i 


EXECUTIVE SUMMARY 
Introduction 


This Current Issue Paper reviews nuclear accidents at Three Mile Island, Chemobyl 
and elsewhere, and considers similarities and differences among these incidents to 
identify factors which are of relevance to Ontario’s CANDU nuclear reactor program. 
Severe nuclear accidents are often defined as those which breach containment and 
expose the public to significant radiation doses, or when an accident ends the plant’s 


useful operation. 
Background 


In nuclear power stations, a controlled nuclear reaction is used to generate heat and 
produce steam which drives a turbine to generate electricity. A number of designs 
have evolved which differ in the way the nuclear reaction is moderated (using ordinary 
water, heavy water or graphite), the substance used for cooling and heat transfer (gas, 
ordinary water, heavy water or liquid metal), and whether the reactor core directly 
heats the water to generate steam or uses a secondary loop to provide steam for the 


turbine. Each reactor technology has examples of successes and failures. 


Nuclear safety philosophies depend first upon accident prevention, through strict 
regulation, quality control and inspections. Should an accident start, reactor designs 
include mitigating systems to shut down the reaction and prevent damage to the plant. 
The third line of defense is the station’s accommodating system, whose role is to 


contain radioactivity released from the fuel. 
Three Mile Island (TMI) 


TMI is a pressurized, light-water reactor complex near Harrisburg, Pennsylvania. In 
March 1979, after less than one year’s operation, a pump providing feed water to the 
reactor core of one unit clogged during full power operation. After the plant shut 
down automatically, a relief valve opened to diminish the built-up pressure and 
temperature, letting out steam and water. This open valve was not detected by 
operators, and in two hours almost a million gallons of coolant water escaped, 


exposing the core, causing some of the fuel to melt. 
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Radiation at TMI was largely confined to the reactor building itself due to containment 
facilities at the site. Only slight public exposure occurred, and no resultant health 


effects are expected. However, public alarm and associated stress were high and more 


than 2000 lawsuits claiming health and psychological damage are pending. 


Major impacts include the permanent loss of the generating capacity of the reactor, a 
billion-dollar cleanup which exceeds the cost of building the reactor, and an inventory 
of radioactive debris and water with no functioning high-level nuclear waste repository 
in the USA. The greatest impact may be increased public fear and scepticism about 


nuclear power. 
Chemobyl 


The Chernobyl reactor was a boiling-water, graphite-moderated reactor of a type 
designated RBMK. It was situated in the Ukraine, with about 45,000 people living in 
the immediate area, and about 150,000 within 30 km. 


During a procedures test, operators disabled several safety systems, and then operated 
the reactor at an unsafely low power level. A design characteristic called the "positive 
void" effect caused the reaction to speed up as coolant levels declined, resulting in a 
rapid power rise and a violent explosion which destroyed the reactor. This breached 
the plant’s partial containment and released a large amount of radioactive fallout. 
Subsequently, the hot radioactive core and buming graphite moderator continued to 


release high levels of radiation for nine days. 


A number of design features, including the positive void coefficient, a slow and 
clumsy control rod system, lack of independent shutdown systems, the use of graphite 
as a moderator and the lack of complete containment all contributed to the accident. 
However, deliberate operator errors, and an "it can’t happen here" attitude were also 


essential components of the disaster. 


Local impacts included at least 31 direct deaths, 237 cases of acute radiation exposure, 
and expected health effects for people living in the immediate area of the reactor. 


Risks for people beyond the USSR are speculative and are statistical in nature. 
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Several contaminated "hot-spots" remain in the Ukraine and Byelorussia. At least 
200,000 people have been moved from their homes, and the accident is said to have 


contaminated almost five million hectares in the Ukraine along with 20% of 


neighbouring Byelorussia. 


The economic costs of the accident at Chernobyl have not yet been fully calculated but 
are enormous. Direct and indirect costs may reach $15 billion, although the long-term 
costs to the USSR to deal with all consequences may be much higher. Agriculture was 
affected in Germany, the United Kingdom, Sweden and other countries where fallout 


accumulated to excessive levels. 
Common Features of Three Mile Island and Chemobyl 


Both accidents happened on the night shift, when operators did not pay attention to or 
did not believe their instruments. In each case reactor designs were sensitive to 
perturbations, and operators took steps to defeat safety systems. Training simulations 
had not anticipated accidents of the types that occurred, and operators had a poor 


understanding of nuclear physics and plant processes. 


In both cases complacency was widespread at all levels. Neither country’s nuclear 


industry believed that a major accident was possible. 


Other Nuclear Accidents 


In the 1950s, the NRX and NRU experimental reactors at Chalk River, Ontario 
experienced accidents which contributed to the design of the safety features found in 
the CANDU series of reactors. Other nuclear accidents have occurred in West 
Germany, the United Kingdom, the USSR, the United States and elsewhere. Military 
facilities were responsible for all the major accidental releases of radioactivity to the 
environment prior to Chernobyl. Isolation of military nuclear programs from the 
mainstream of science and technology has been cited as breeding complacency and 


ignorance of improved methodologies. 


CANDU and Chemobyl 


The CANDU reactor design is very different from the Soviet RBMK in that it uses a 


different moderator (heavy water versus graphite), coolant (heavy water versus light 
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water), fuel (natural uranium versus 2% enriched uranium) and has an indirect steam 


cycle, whereas, in the RBMK, steam from the reactor goes directly to the turbines. As 


well, the RBMK lacks full containment and has a slow shutdown system. 


There are, however, three major similarities between the two reactor designs. The 
CANDU has a positive void coefficient, although smaller than that of the RBMK. 
This characteristic causes an increase in reactivity when coolant is lost, and was 
termed by the Ontario Nuclear Safety Review (Hare Commission) as one of CANDU’s 
"less desirable characteristics." The CANDU designers initially responded to the 
challenge of a positive void factor with a faster and more substantial shutdown system, 
and, unlike the RBMK, most CANDU reactors have two fully effective and 
independent shutdown mechanisms. Experts note that every reactor design has the 
potential for large reactivity increases, but only the RBMK did not recognize this 
adequately. 


A second common feature is that both the CANDU and RBMK designs can be 
refuelled without shutting down the reactors, meaning that the stations may produce 
power for a greater proportion of time than other designs. The RBMK’s overhead 
fuelling gantry fell on the reactor during the Chernobyl accident, but the front and back 
fuelling of the CANDU would eliminate this possibility. Some experts noted that 
dispersing the fuel in rods as done in RBMK and CANDU has safety advantages 
compared with the bundling of fuel in other reactor designs. 


A final common design feature is the use of pressure tubes in contrast with the large 
pressure vessels used in other reactor designs. While one report suggested that 
pressure tube failure may have been a major contributing factor to the Chemobyl 
accident, most analyses do not appear to include such a conclusion. Certainly 
premature tube failures have plagued Ontario’s CANDU reactors, and the Hare 
Commission commented on this phenomenon at length. The present analyses appear 
to consider potential tube failures as a serious economic factor rather than a safety 
issue, but the Commission expressed concern regarding possible risks to workers, if 
not the public, and strongly recommended accelerated research efforts related to all 


aspects of premature pressure tube aging. 


The use of pressure tubes does have many advantages, and some reviewers have noted 
that a catastrophic explosive rupture of the single pressure vessel in other reactor 


designs is an event for which containment systems offer little protection. 
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Human Factors 


Both the Three Mile Island and Chernobyl accidents were characterized by major 
operator errors and a failure to anticipate the events which occurred when training 
crews. Isolation and complacency have been significant contributors to most severe 
nuclear accidents. This is particularly true of military facilities. An important 
requirement is that operational staff members have a good understanding of nuclear 
processes so that they fully appreciate the risks involved with non-standard operation 
of their plants. In retrospect, it becomes clear that for both Three Mile Island and 
Chernobyl, the regulatory agencies, managements, and operating staffs did not truly 


believe a major accident was possible. 


Ontario Hydro has received favourable reviews from the Hare Commission and others 
regarding commitment to safety, quality of training, and other aspects required to 
develop a sound safety culture. Reports of understaffing and excessive stress, 
particularly at the senior operator level, and poor morale of other operations staff 
suggest that there is still room for improvement. Excellence in personnel performance 
in the design, construction, operation and maintenance functions may be more 
important than the type of technology used in assuring the safety of commercial 


nuclear power. 
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1 
INTRODUCTION 


Nuclear energy has been a part of life in the developed world for two generations. In 
each of the years 1984 and 1985, 33 new commercial nuclear power plants came into 
operation in the world, or one new plant every 11 days on average. | The world total 
of nuclear power plants in commercial operation in May 1990 was 428, with 26 
countries now producing electricity from atomic energy.” France tops the list with 
75% of its electricity coming from 54 operating units. Belgium is the runner-up with 
61% and the Republic of Korea generates one-half of its power through nuclear 
means. The United States has 112 commercially-licensed nuclear plants, representing 


20% of its electrical energy generation. 


Few new nuclear power plants were ordered, particularly in the USA, since the 1970s. 
This hiatus appears to be largely due to the over-ordered situation in 1973, and there 
has been no reason for any US utility to order a power reactor since.? Over-building 
led to plants being completed when there was no need for the electricity or to plant 
construction being stretched out to avoid coming on-line when not needed. In either 
case, utility commissions looked sceptically at the costs. Lack of demand continues to 
be a major factor inhibiting the return on nuclear power in the United States. 
According to one respected analyst, this could change if large demand growth were 


perceived to be real, or indeed, if it were real.4 


Nuclear power has several attractive features. Supplies of uranium fuel are plentiful in 
Ontario, Saskatchewan and elsewhere in Canada. The generating facilities emit no 
sulphur dioxide, nitrogen oxides or carbon dioxide. If the electric energy that was 
derived from nuclear power world-wide in 1988 had instead been produced by 
coal-fired plants, this would have given rise to additional emissions of carbon dioxide 
of about 1,600 million tons. The present pattern of demand for electricity has 
traditionally been met in most developed countries by either coal-fired or nuclear 


generating stations. 


Misgivings about present and potential use of nuclear power largely relate to concerns 
about public and worker safety, radioactive waste disposal and the possible risk of 
proliferation of nuclear weapons. This paper considers only the first of these: certain 
aspects of safety. In particular, this is a review of several major nuclear accidents 


around the world, rather than an analysis of smaller, although important, in-plant 
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malfunctions or safety problems which may affect operating staff without directly 


putting the public-at-large at risk. 


The Hare Commission, which recently reviewed the safety of Ontario’s nuclear power 


reactors, defined a "severe" accident as one that breaches containment and releases 


sufficient radioactive material to expose the nearby public to significant doses.> 


Another recent review categorized reactors as "safety failures" when an accident ends 


their operation. This paper is generally guided by those definitions. 


Risks of nuclear technology do exist. Complex technologies fail because of human 
and technical error, sometimes with serious results. The plant operators at Chernobyl 
were performing a safety check when they lost control of the reactor. Three Mile 


Island approached core meltdown because of a delay in the recognition of equipment 


6 


malfunction. 


A recent analysis of the Chernobyl accident prepared for physicians made the 


following observation: / 


To live responsibly with modem technology, one 
must clearly describe and understand both the risks 
and the benefits. The equation should include 
preventative measures as well as a realistic plan for 
responding to nuclear accidents. This assessment 
process requires an arena rendered as open and 
democratic as possible, in the tradition of medical 
informed consent. Medical training focuses on the 
development of the capacities to evaluate risk, reduce 
error, and acknowledge either or both wherever they 
exist. If we examine the lessons of Chemobyl and 
our own experience of nuclear technology and 
disaster management in this light, we can learn from 
them. 


This philosophy may provide a useful approach to considering the implications of the 
nuclear accidents which are described in this report. Neutral, objective debate 
regarding the risks and benefits of nuclear power is rare in the polarized information 
which appears in the media in Ontario and elsewhere. However, both aspects wil 
have to be carefully considered if energy planning mm the province is to proceed 


effectively. 
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BACKGROUND 


General Principles of Nuclear Power 


While the engineering problems of nuclear power are complicated, the underlying 


principles are simple.8 


Reactors produce heat by splitting the nuclei of such 
fissile elements as uranium and plutonium, packaged 
as fuel shaped into rods or pellets. Fission begins 
when a fissile isotope absorbs a neutron and decays 
into lighter elements, releasing energy in the form of 
recoiling fission fragments, gamma rays and a 
shower of energetic neutrons. 


The neutrons stimulate other atoms to fission, 
releasing yet more neutrons in a self-sustaining 
process called a chain reaction. Reactors tame the 
chain reaction by controlling the neutron population 
with neutron absorbing control rods and by reducing 
the neutrons’ kinetic energy with moderating 
materials. The fuel, the control rods and moderator 
together constitute the reactor’s core. Flowing 
coolant extracts the heat liberated in fission to make 
steam, which in turn spins the turbines that drive the 
electric generators. (Such cooling must continue 
even if the chain reaction is shut down, or else the 
decay of radioactive fission products will overheat 
the core, causing it to release its contents.) 


Simply stated, a controlled nuclear reaction is used to generate heat and create steam 


which drives a turbine to produce electricity. 


Types of Reactors 


Nuclear reactors are usually defined in terms of the types of materials used to cool and 


moderate the reactions within. 


The experience of nearly four decades has winnowed out designs for four basic types 
. 


of reactors: 


: the heavy-water reactor (HWR); 
° the light-water reactor (LWR), 
° the gas-cooled reactor (GCR); and 


° the liquid-metal-cooled reactor. 
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In heavy-water reactors, such as the CANDU family developed in Canada, the core is 
cooled and moderated by "heavy" water, so called because some of the hydrogen 
atoms have been replaced by deuterium, a rare, heavy isotope of hydrogen. The 
deuterium’s cost is offset by the reactor’s ability to use natural uranium, in which the 
rare, highly-fissile isotope uranium-235 has not been concentrated.!9 Canada is the 


major user of commercial HWRs in the world today. 


Light-water reactors, in which ordinary water serves as both the coolant and the 
moderator, come in two versions; the boiling-water reactor (BWR) and the 
pressurized-water reactor (PWR). The BWR has a single thermal cycle wherein the 
core directly heats the water to generate steam. The PWR has two cycles; one 
employs a circulating loop of pressurized (hence, non-boiling) water to extract heat 
from the core, while the other uses that heat to generate steam. Both designs are in 
service throughout the industrialized world, in versions manufactured by companies in 
the United States, France, West Germany, Japan, Sweden and the USSR.11 


Gas-cooled reactors have been built since 1956, at the beginning of the civilian nuclear 
power era, |2 Although the nuclear power industries of Great Britain and France 
were founded on versions of this technology, the high capital costs and low reliability 
association with the GCR have since led both countries to abandon it in favour of 


LWRs. 


Liquid-metal-cooled reactors, designed in "breeder" configurations, produce more fuel 
than they consume by converting non-fissile uranium-238 (more than 98% of natural 
uranium) into fissile plutonium-239, a reactor fuel. Because breeders consume 
uranium so efficiently, they can give substantial electric energy independence to 
countries that lack indigenous uranium resources. However, the liquid-metal coolant, 
generally sodium, is reactive with air and water, and so requires expensive measures to 
prevent chemical fires and explosions. Second, some fear that the plutonium produced 
would make the substance so widely available that an international traffic in the metal 


would result, impairing efforts to limit the proliferation of nuclear arms. 13 


A fifth category of nuclear power plant is also of interest, this being the Soviet RBMK, 
which uses solid graphite as a moderator and light water as a coolant to generate steam 
to run its turbines.!4 The USSR also designs and operates PWR stations. In the 
RBMK design, 2% enriched uranium oxide fuel is placed in about 1,660 vertical 


pressure tubes imbedded in graphite moderator blocks. The steam cycle is direct, in 
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that steam and water from the reactor are separated and steam goes directly to 
turbines.19 The RBMK reactor will be discussed in more detail in a later section of 


this report. 


Each reactor technology provides examples of success and failure. Most of the 
failures resulted from either human errors or subtle phenomena that were hard to 
anticipate. 16 Examples of safety and economic successes and failures among several 
reactor types are listed in Table 1. That American review did not consider heavy water 


reactors such as CANDU since they are not used in the United States. 
Nuclear Safety Philosophy 


The experience of industrialized countries has revealed vulnerability in current nuclear 
power plant designs that was not fully understood when the plants were designed. 
Among the most important concerns are human error, materials degradation, accidents 
resulting from chains of subtle failures, and the economic sensitivity of nuclear 


projects to disruption and poor workmanship. 17 


Reduction of these risks benefits the owner of the plant as well as the public since it is 
far more likely that an accident will destroy the value of a power plant than injure the 
people who live nearby. The accident at Three Mile Island, for instance, eliminated 


the equity in the plant but did not harm the surrounding population with respect to 


radioactive contamination. 18 


Essentially, there are two main safety issues with nuclear power plants: 19 


° are the reactors safe while operating normally? and 

° what kind of accidents are possible and what would be their consequences? 

In each case, the main threat is from exposure of workers and the public to dangerous 
radiation. Since almost all the radioactivity is in the fuel, and can only get out if the 


fuel overheats, the need is to control the power and keep cooling water on the fuel.29 


This involves three lines of defence: 


° accident prevention; 
: accident mitigation; and 


° accident accommodation. 
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TABLE I 


Successes & Failures of Major Reactor Technologies 


Successes: 


Economic Failures: 


Safety Failure: 


Successes: 


Economic Failure: 


Safety Failures: 


Successes: 


Economic Failures: 


Safety Failure: 


Light-water Reactors 


Plants in France, Switzerland, West Germany, Japan, 
Sweden, Finland, Korea and most plants in US. 


Midland, Michigan; Zimmer, Ohio; Rancho Seco, 
Califomia; Marble Hill, Ind.; Shoreham, L.I. 


Three Mile Island 2, Pa. 


Liquid-metal-cooled Reactors 


Phoenix, France; Dounreay, UK; Fast Flux Test Facility, 
Wash.; Experimental Breeder Reactor LU, Idaho. 


SNR 300, West Germany. 


Fermi I, Mich.; Experimental Breeder Reactor I, Idaho. 


Gas-cooled Reactors 


Peach Bottom, Pa.; AVR, West Germany. 

Fort St. Vrain, Colo.; the gas reactor programs in France 
and UK; Thorium High-Temperature Reactor 300, West 
Germany. 


Windscale, UK. 


SUCCESSES AND FAILURES of the major 
reactor technologies are listed in this table. A 
plant is an economic failure when it costs so 
much or provides power so infrequently that it 
is not worth operating; it is a safety failure 
when an accident ends its operation. Three 
Mile Island plant 2, for example, is a safety 
failure because an accident in 1979 put it out of 
comunission. The Shoreham, L.L, plant is an 
economic failure because state authorities will 
not allow its owners to recoup their investment. 


Source: M.W. Golay and N.E. Todreas, "Advanced light-water reactors," Scientific 
American (April 1990): 87. 
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The following is a brief overview of the safety philosophy of Atomic Energy of 
Canada Limited and the Atomic Energy Control Board regarding the design, 


construction and operation of its CANDU reactors. 


Accident prevention is the most important thing to 
do, and it is done by strict quality control in 
manufacture and construction, by inspecting the plant 
while it’s running, and by using operating experience 
to fix up small problems before they become large 
ones. 


If an accident starts, the next step is to arrest it before 
it damages the plant. In CANDU reactors, the 
normal control systems are powerful enough to do 
this for most accidents. They are backed up by 
separate systems dedicated only to safety - shutdown 
systems to turn off the power if it starts to go up 
higher than it should, and emergency core cooling, to 
replace cooling water if it should be lost from a pipe 
break. These are the CANDU mitigating systems. 


The CANDU goes one step further and allows for the 
possibility that fuel is damaged regardless, and so it 
has an accommodating system - containment - also a 
safety system, but whose role is to contain 
radioactivity released from the fuel. There is also a 
one-kilometer ring of land around the reactor - called 
the exclusion zone - which allows dilution of any 
radioactivity released, jn an accident before it can get 
to where people live. 


Clearly, accident prevention is the most effective way of ensuring safety. Should a 
reactor get out of hand and accident conditions arise, there is an immediate need for 


emergency measures. These are of three kinds:22 


° restoration of the reactor to safe conditions, which is the responsibility of the 
operators in the control room and the other staff on duty at the time; 


° emergency procedures within the station to protect workers and equipment and 
to prevent or minimize danger to the public; and 


° emergency measures in the civil community around the station and (in severe 
cases) farther afield. 


The recent Hare Commission, in its Ontario Nuclear Safety Review, examined the 
adequacy of these types of measures with respect to CANDU reactors operated by 
Ontario Hydro. That review should be consulted regarding details. Another aspect of 
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the nuclear safety philosophy that receives little public discussion is that of security, 
particularly from the action of terrorists. A team of commandos sent to test security at 
French nuclear power stations apparently penetrated one near Lyon with little 
difficulty. The commandos’ sudden appearance in the central control room reportedly 
caused no concern, since the technicians assumed they must have been allowed 
entry.22 In addition to carrying out the successful "penetration" test, security 
reviewers also found people who are on terrorist and criminal files employed by 
subcontractors and, in one case, former Red Brigade members were reported to have 


worked as cleaners at one nuclear site. 


While Electricité de France officials dismiss many of these allegations as being "pure 


"24 it is clear that in today’s world, the preparation and effective 


make-believe, 
maintenance of sound security plans is essential to ensure the safety of any nuclear 


facility and the surrounding population. 


THREE MILE ISLAND 


The Plant 


The Unit 2 reactor (TMI-2) was a pressurized-water facility (PWR)2> situated on an 
island in the Susquhanna River, 12 miles southeast of Harrisburg, Pennsylvania. It and 
its undamaged twin were manufactured by Babcock and Wilcox at a cost of US $700 
million.2© 

At 4:00 a.m. on March 28, 1979, TMI-2 was operating normally at nearly 100% rated 
power.*/ At this power level, about 2,700 megawatts of thermal energy were being 
generated by the reactor, which heats the primary coolant to 600°F at high pressure. 
This coolant was pumped through steam generators where it gave up its energy to 
create steam in the secondary loop, which drove a conventional steam turbine to 
generate about 1,000 megawatts of electrical energy. TMI-2 first went critical exactly 
one year to the day before the accident. It had been declared operational at the end of 
December 1978. 


The Accident 


Detailed chronologies of the accident at TMI-2 have been prepared by Jaffe (1981)28 


and by the US Nuclear Regulatory Commission’s Special Inquiry Group.2? The 


following is a brief synopsis of the major events:20 
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The accident at TMI Unit 2 began after only 11 
months of operation when a pump _ providing 
feedwater to the reactor core clogged during full 
power operation. After the plant shut down 
automatically, a relief valve opened to diminish the 
built-up pressure and temperature in the reactor, 
letting out steam and water. 


Undetected by the operators, this valve remained 
open for 2 hours, allowing the escape of nearly a 
million gallons of the coolant water covering the 
reactor fuel. As approximately half of the reactor 
core became uncovered, the radioactive water 
overflowed designed catchments, collecting in the 
basements of the reactor and auxiliary buildings. 
Without the coolant water, temperatures in the 
pressurized-water reactor rose quickly, causing some 
of the uranium fuel to melt. 


Local Impacts 


Radiation at TMI-2 was largely confined to the reactor building itself due to the 


containment facilities at the site. However, some public exposure did occur. 


The accidental radiation received by people residing in the vicinity of TMI-2 came 
almost entirely from xenon-133 (half-life, 5.3 days), xenon-135 (half-life, 9.2 hours), 
and traces of radioactive iodine (principally iodine-131 (half-life, 9.0 days)), which 
escaped intermittently from the plant as gases. 1 Since these radioactive gases 
followed prevailing winds, they increased the level of ionizing radiation along their 
path; however, the increase was short-lived because xenon, which is relatively inert 
chemically and biologically, dispersed rapidly. Also, radioactive iodine was present 
only in barely detectable amounts to begin with. No release of long-lived fission 


products, such as strontium-90, caesium-137 and plutonium-239 was detected.>2 


Based on all of the available measurements, investigators concluded that the maximum 
cumulative whole-body radiation dose to anyone off-site was less than 100 millirems 
(mrem), that the average cumulative dose to those within 10 miles of the plant was 
about 8 mrem, and that the average cumulative dose to those within 50 miles of the 
plant was about 1.5 mrem. Because these estimates made no allowance for shielding 
by shelter or other attenuation factors, they were generally considered to represent 


overestimates.>> Health workers came to the following conclusions: 
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The only health impact of the Three Mile Island 
accident that can be identified with certainty is 
mental stress to those living in the vicinity of the 
plant, particularly pregnant women and families with 
teenagers and preschool children. Although 
increased risks of cancer, birth defects, and genetic 
abnormalities are potential long-term consequences 
of low-level irradiation, few if any such effects of the 
accident are likely, because the collective dose of 
radiation received by the population within a 50-mile 
radius of the plant was so small. Estimates of the 
number of people in the population who may 
ultimately experience any such effects range from 0.4 
to 10, in comparison with hundreds of thousands in 
the same population who can be expected to develop 
cancer, birth iad or genetic abnormalities 
through natural causes. 4 


An epidemiologist at Columbia University’s School of Public Health has subsequently 
studied the incidence of cancer around Three Mile Island, using data from 69 small 
tracts that were within 16 km of the plant, and comparing them with national rates and 
with cancer rates in a data base for the Southeast Pennsylvania Region as a whole.>> 
The 1990 study found no evidence that radiation released during the 1979 accident 


caused an increased risk of cancer in the area nearby. 


More than 2,000 lawsuits claiming health and psychological damage from the TMI-2 
accident are still pending?© despite measurements after the event that showed that the 
highest possible whole-body dose to any one individual was less than 100 mrem, or 
only slightly greater than the average most people are exposed to from medical and 


dental radiation in a year. 


Low levels of radioiodines and trace radioxenons collected in environmental samples 
(surface waters, effluent, vegetation, aquatic biota) taken from the area around TMI-2 
indicated that releases of radioactive material from the accident were not 
environmentally significant. All of the off-site analytical results were significantly 


below regulatory limits.37 


Other Impacts 


The fact that significant amounts of radioactivity were not released from TMI-2 
fortunately meant that there were no widespread health or ecological impacts. 
However, there have been many long-term implications of this accident. A recent 


review pointed out several of these:3® 
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° A decade later, cleaning up the site continues at a cost of $1,000 million - 
nearly $300 million more than the cost of building the reactor in the first place. 


° The "de-fueling" process should be complete by the end of 1990, when Unit 2 
will be shut and monitored for about 30 years, until the end of the planned 
lifespan of the operating Unit 1 nearby. Both units would than be 
decommissioned and dismantled together. 


° Because residual caesium has permeated the basement walls, unacceptable and 
potentially dangerous levels of radiation will remain until deconunissioning. 


° The generating capacity of Unit 2 is permanently lost. 
° One hundred and fifty tons of highly radioactive debris have been removed 


from the reactor but, since there is not yet a functioning repository for 
high-level commercial nuclear waste in the US, it continues to be "temporarily" 


stored in Idaho. 

° A plan to evaporate the remaining two million gallons of radioactive water at 
the TMI-2 site still awaited approval from the Nuclear Regulatory Commission 
in 1989. 

° Most agree that the incident’s greatest legacy is a sustained level of lingering 


public fear and opposition to nuclear power in the United States. 


° Although performance has improved and dependence on nuclear power as a 
fraction of energy supply in the US has since grown, no new nuclear plants 
have been ordered since the aCeIds t, and all of the 47 units ordered in the US 
since 1974 have been cancelled.” (As noted earlier, over-supply of power 
plants for the existing demand for electricity was also a major factor in the lack 
of orders for new plants.) 


In summary, while Three Mile Island may not have been a "severe" accident as 
defined by the Hare Commission, in that it did not breach containment and release 
sufficient radioactive material to expose the nearby public to significant doses,49 the 
generating potential of TMI-2 was permanently lost and the psychological impact on 
the American population has resulted in lasting scepticism about nuclear energy. 
While the increasing US demand for electricity and growing concerns over gaseous 
emissions from fossil fuel-fired generating stations will likely result in resurging 
interest in advanced LWRs or newer designs for “inherently safe" reactors in the 
future,“ the effect of the Three Mile Island accident on the industry and the US 


public can only be described as serious. 
CHERNOBYL 
The Plant 


As noted earlier, the power plant at Chernobyl was equipped with boiling-water 
pressure tube reactors termed RBMKs. Fifteen RBMK-1000 plants like those at 
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Chernobyl, each generating 1,000 megawatts of electricity, provide more than half of 


the Soviet Union’s nuclear-generated electrical capacity.42 


The Chernobyl site, with four completed reactors and two additional ones under 
construction, is located on the Pripyat River, approximately 24 km northwest of the 
town of Chernobyl and 110 km north of Kiev (Figure 1). The nearest town is Pripyat, 
which grew up around the power plant.43 At the time of the accident, about 45,000 
people lived within the immediate neighbourhood of the plant, and about 150,000 
within 30 km. ‘ 
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Source: D.R. Marples, "Chernobyl: Its effects in the USSR," Forum for Applied 
Research and Public Policy (Summer 1990): 7. 
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The following is a brief description of the main features of the RBMK reactor. 


The Chernobyl reactor was of a type referred to as 
RBMK in which the neutron-moderating material is 
graphite and the fuel is cooled by ordinary water (in 
CANDU reactors, heavy water is used for both these 
functions). In the RBMK design, steam is produced 
directly in the fuel cooling system, whereas the 
CANDU utilizes steam generators in which the heat 
removed from the fuel by the heavy water is used to 
boil ordinary water. 


In the Chernobyl reactors, much of the fuel cooling 
equipment is contained within _ leak-tight 
compartments which are intended to fulfill a function 
similar to that of the concrete containment buildings 
in which CANDU reactors are required to be housed. 
However, the reactor and the piping which exits 
above the top of the reactor are not contained in such 
a compartment. 


The RBMK design includes emergency protective 
mechanisms which are designed to shut the reactor 
down if a hazardous condition is detected. The rate 
of shutdown is rather slow, and the success of the 
protective action depends on supplementary action by 
control rods which normally are partially inserted 
into the reactor. 


The feature of the reactor which played an important 
part in the accident was a characteristic known in 
technical terms as a positive void coefficient of 
reactivity. This means that when the amount of 
steam (or void) in the reactor increases, there is a 
feedback effect which, if not controlled, will cause 
the power of the reactor to increas¢, and thereby 
further increase the void in the reactor.*+ 


The Accident 


The Atomic Energy Control Board of Canada prepared the following description of the 
events leading up to the accident. Table 2 summarizes the sequence of major events 


preceding the initial explosion. 


In the course of shutting down the reactor for routine 
maintenance, the operators were conducting a test to 
demonstrate that, after the steam supply to a turbine 
had been cut off, the mechanical energy of its rotor 
could be hamessed to supply electrical power to 
important equipment for about 50 seconds. 


TIME 


April 25 
01:00 


13:05 


14:00 


Apnil 26 
00:28 


01:00-01:20 


01:20 


01:23 


01:23:40 


01:23:44 


Source: 
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TABLE 2 


EVENT SEQUENCE AT CHERNOBYL 


Reactor at full power. 
Power reduction began. 


Reactor power 50%. 
All steam switched to 
one turbine. 


Reactor power stayed at 
50% for 9 hours because 
of unexpected electrical 
demand. 


In continuing the power rundown, 
the operator made an error which 
caused the power to drop to 

30 bE almost shutting the 
reactor off. 
The operator managed to raise 
power to 200 MW(th). He 
attempted to control the reactor 
manually, causing fluctuations 
in flow and temperature. 


The operator blocked automatic 
reactor shutdown first on low 
water level, then on the loss 

of both turbines. 


The operator tripped the 
remaining turbine to start 
the test. 


Power began to rise rapidly. 


The operator pushed the manual 
shutdown button. 


The reactor power reached about 
100 times full power, fuel 
disintegrated, and excess steam 
pressure broke the pressure tubes. 


COMMENTS 


As planned. 


As planned. 


This caused the core to 

fill with water & allowed 

xenon (a neutron absorber) 

to build up, making it 

impossible to reach the planned test power. 


The RBMK design is unstable 

with the core filled with 

water -- i.e., small 

changes in flow or 

temperature can cause large power changes, 
and the capability of the emergency shutdown is 
badly weakened. 


He was afraid that a 

shutdown would abort the 

test. Repeat tests were 

planned, if necessary, and he wanted to keep 
the reactor running to do these also. 


The reduction in flow as the voltage dropped 
caused a large and fast increase in boiling 
leading to a fast power rise. 


Too late. The damage was 

done in the next four seconds. The emergency 
shutdown would have taken six seconds to be 
effective. 


The pressure in the reactor 
core blew the top shield 

off and broke all the 
remaining pressure tubes. 


V.G. Snell and J.Q. Howieson, Chernobyl - A Canadian Perspective (Mississauga: Atomic Energy of 
Canada Limited, December 1986), p. 9. 
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While reducing power in preparation for this test, the 
operators made a simple error which caused the 
reactor power to be reduced to a low level, at which 
very little steam was being produced in the reactor. 
Under the conditions which existed at that point, the 
characteristics of the reactor made it difficult to 
re-establish the required power, and the test should 
have been aborted. 


In an effort to increase reactor power to a level at 
which the test could be performed, the operators 
committed several serious violations of the rules for 
safe operation of the reactor. In particular, they 
blocked several of the signals which could have 
initiated an emergency shutdown, and removed from 
the reactor most of the control rods which are 
required to supplement the emergency shutdown 
action. These violations seriously impaired the 
capability of the emergency shutdown equipment. 


The operators succeeded in restoring power to a level 
at which they believed they could conduct the test, 
although the condition of the reactor was still such 
that there was very little steam in the core. When the 
test was initiated, the flow of coolant in the reactor 
decreased and the rate of steam production began to 
increase. Because of the positive void coefficient of 
reactivity discussed above, the steam production 
produced a feedback effect which caused the reactor 
power to increase. The control system was unable to 
cope with this power increase, and under these 
conditions the emergency shutdown equipment could 
not act quickly enough to terminate it. The result 
was a rapid uncontrolled rise in reactor power which 
was terminated only when there was a violent 
eben oneantenidetnoredthercestera a 
plosion which destroyed the reactor. 


The steam pressure as the reactor went to between 100 and 500 times full power lifted 
a 1,000-ton cover plate, turned it on its side, and ripped open the reactor, leaving the 
hot core exposed to the environment.4® A large initial release of radioactive 
material, which included fragments of the fuel, resulted. After this large, explosive 


release, the emissions from the damaged reactor fell to a low level.47 


The first attempt to control the reactor after the accident was made by local personnel 
before the Moscow experts arrived. Their attempt to flood the damaged reactor failed 
because water passed through passages between the different reactors, threatening the 
integrity of the adjacent units (this is a small but important design flaw).48 Later that 
day, it was realized that the graphite in the reactor was burning, and radioactivity 
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releases were increasing. Then, on April 27, 1986 and succeeding days, 5,000 tonnes 
of material was dropped by helicopter. This smothered the fire, but the heat of the 
radioactivity still kept the core hot and continued to evaporate fission products. Not 
until liquid nitrogen was introduced into passages below the core did it cool and the 


releases stop.49 


Until this happened, heat from the decay of the residual fission products caused the 
temperature within the remaining core to rise to the point where fission products began 
to distill out of the reactor. Nine days after the initial accident, the daily release rate of 


radioactive material was nearly as high as it was at the time of the initial release.-0 


Since the emission of radioactive material from the reactor resulted from two 
important but different controlling processes, the release fraction of the core inventory 
of radionuclides varied substantially according to the volatility of each chemical 
element. Essentially, all of the noble gases, roughly half the volatile elements 
including iodine-131, isotopes of caesium (Cs-134, Cs-137), and only a small 
percentage of the refractory materials (those having high melting points) including 
isotopes of strontium (Sr-89, Sr-90), cerium (Ce-141, Ce-144), and plutonium (Pu-238, 
Pu-239, Pu-240) were released.! It should be noted that strontium-90 and 


caesium-137 are long-lived fission products. 


After the accident, the initial plume dispersed to the northwest and reached Finland 
and Sweden. Early detection alerted the European nations to the occurrence of a major 
nuclear reactor accident, until then unannounced by the Soviets. Because the release 
occurred over many days under changing meteorological conditions, the overall 
trajectory of the plume was complex. Scandinavia, eastern Europe, and, at later times, 


southern Europe were most heavily affected.> 2 


Following the initial response, the next step taken was to enclose the damaged Unit 4 
in a sarcophagus to prevent any further radioactive releases. This was finished in 
October 1986. Massive new foundations were built by burrowing below the reactor, 
and heat exchangers were installed to allow the decay heat to be removed. Almost no 
radioactivity now escapes.2> After Unit 4 was enclosed, decontamination of the 
others was undertaken with Units | and 2 being restarted in October and November, 
respectively. The sarcophagus built to contain the reactor core is now cracking.>4 A 
major issue in the Soviet Union is whether to build a new structure around the 


breached containment of the sarcophagus, or rather to first remove radioactive 
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materials from the core for underground burial. The high level of emotion associated 
with environmental issues in the USSR today has made this a highly-publicized, 


widely-debated issue. 


While the Ukranian parliament voted in August 1990 to close the remainder of the 


Chernobyl power station,> 


the decision is yet to be reviewed by the Supreme 
Soviet.-© Since the three functioning units contribute a substantial proportion of the 
energy supply of the Ukraine, it is uncertain where replacement electrical generation 


would come from. 
Reasons for the Accident 


In addition to the operator errors which were noted earlier, reviews of the Chernobyl 
accident have identified several major design features and management characteristics 


which appear to have contributed to the incident’s occurrence and severity.>/ 
Design shortcomings include: 


° a slow and clumsy control rod system; 


° a "positive void coefficient" which means that as water is lost to steam, the 
reaction speeds up leading to more water boiling and producing a positive 
feedback to encourage the reaction to speed up. This instability is particularly 
dangerous at low power; 


° it appears that the design of the plant permitted the operators to easily disable 
several important parts of the reactor’s safety system; 


° the solid graphite moderator could not be rapidly displaced to terminate a 
power excursion. As well, once the graphite began to bum, it produced 
additional intense heat and an updraft of hot air which carried radionuclides far 
afield; 


° the RBMK reactor has an inadequate containment system by world standards. 
No kind of containment surrounds the tube, control and refueling systems at the 
reactor’s top, so if it lifts, radioactive and irradiated materials escape directly 
into the poorly-sealed building and hence into the environment; 


° the design and operation of the RBMK reactor appears to place a very high 
reliance on correct operator action. While operation of all reactors depends on 
correct action by plant operators, most designs are much more tolerant of 
operating errors than is the Chernobyl! design; and 


. the RBMK reactors are not equipped with shutdown systems which are 
independent from the control system. 
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As well, management errors contributed greatly to the accident at Chernobyl. 


Examples include: 


° while the RBMK’s designers knew of its technical design shortcomings, and 
devised a set of operating rules to be rigidly followed, they seem to have made 
little attempt to educate the plant operators. Six important safety devices were 
deliberately disconnected on the night of April 25, and the reactor was 
deliberately and improperly run below 20% power. These incidents may not 
have pegs if the operators had understood the elementary physics of their 
reactors;~° and 


° the official line of the Soviet Academy of Sciences was that an accident such as 
Three Mile Island can only happen in a capitalist society where they put profits 
ahead of safety. While this was obviously a political viewpoint, there was a 
danger that professional safety people would beligye it. The "it can’t happen 
here" philosophy appears to have been widespread. 


In 1990, the Soviet Union has reopened the official inquiry into who should bear 
responsibility for the accident.°9 The original commission, set up immediately after 
the accident, placed the blame on operator error. Now, a new, independent 
commission convened by the State Committee for Industrial and Nuclear Power Safety 
is said to be preparing to consider whether the design of the RBMK reactor was itself 
inherently unsafe. Earlier claims that, until Chernobyl, the RBMK had an 
accident-free record are now reported by the State Committee for Nuclear Safety to be 
false. There apparently had been a "class three" ("serious") accident in the No. 1 


reactor of the Leningrad station in November 1975.61 


In a recent interview, the director of the Chernobyl plant described the many technical 
improvements and new safety systems which had been installed that are designed to 
prevent the type of accident which occurred in 1986.92 He noted, however, that the 
days of the RBMK are numbered. A major problem has been the expansion of the 
graphite through radioactivity, which entails replacing the fuel channels at 15-year 
intervals. To alleviate this problem, a major technical modification is required, and 
this would extend the operating span of the reactor to the regular 30 years. The future, 
however, was said to lie with the VVER (water-pressurized) reactor type, moderated 


by helium. 


Radiation levels recorded in June 1989 indicated that at a distance of 300 m from the 
sarcophagus, the level was 1.2 millirems per hour, or about 160 times the natural 


background. Closer to the damaged reactor, the level was 1000 times normal.® 
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Local Impacts 


In contrast to the Three Mile Island accident, significant escape of radiation occurred 
at Chernobyl. While the health effects of high doses of radiation are fairly well 
known, the long-term impacts of low-level radiation exposure are more speculative, 
since predictive methods involve extrapolation of the health effects of people exposed 
to various levels of radiation at Hiroshima and Nagasaki. In other words, effects are 
predicted on the basis of probability. The difficulty of assigning those Japanese 
victims to specific exposure categories means that there is considerable uncertainty 
and debate about the health effects of low-level radiation exposures in professional 


public health circles. 


A study of the health mmpact of the Chernobyl accident©* indicated that no acute 
effects have occurred outside the Soviet Union, where 237 cases of acute radiation 


sickness, including 31 deaths (as of 1988), were reported. 


Those workers and populace in the 30-km zone surrounding Chernobyl may 
experience some detectable increase in health effects in the years to come. Given 
present early data, a doubling of leukemia risk was be expected for the period 
1988-1989. Some possibility also exists of a few added cases of severe mental 
retardation in recent children of this exposed group. No adverse genetic effects were 


predicted to be observed in the entire group.°- 


Those near the site who experienced acute radiation sickness have increased risk of 
leukemia and other forms of cancer, depending on the type of exposure pathway and 
the degree of exposure .©© A Soviet helicopter pilot, who made four flights in five 
days over the plant through radioactive gases to dump materials, recently underwent a 


bone marrow transplant in Seattle to combat leukemia and subsequently died.©7 


Other reports have suggested that 2,000 soldiers consigned to duty in the 30-km 
exclusion zone for over two years were allowed to absorb more radiation than the 
civilians they worked alongside. As well, a hunger strike by sick rescue workers from 
the Chernobyl zone was reported, in which they were protesting against hospital 
officials who refused to admit a link between their illness and the radiation from the 


accident.©8 
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Some measures which have been instituted suggest that the scale of the contamination 
may be worse than first thought.9? Mikhail Gorbachev is reported to have ordered 
that holidays should be offered to all children that need them, away from the areas 
contaminated by the fallout from the accident four years ago. A special health farm is 
to be set up, because following the incident, children in the settlements near the plant 


have not been able to play outside at all, causing physical and emotional deterioration. 


Cleaning efforts concentrated on the 30-km inner zone, which is now fit for the 
cultivation of crops in greenhouses as near as 3 km from the plant. But outside the 
zone, there are still a few "hot spots" where contamination by caesium-137, one of the 
longer-lasting isotopes, is excessive. /0 Maps showing the extent of contamination 
are still incomplete. So far, only caesium fallout has been documented, and maps of 


strontium-90 contamination are to be published later in 1990. 


Some reports have suggested that studies to date have not taken into account illnesses 
other than those directly attributable to radiation. One medical researcher from Minsk 
in Byelorussia, which received some 70% of the fallout, reported that the incidence of 
tuberculosis has risen by 14% since the accident, and suggested that ruthenium affects 
the lungs, weakening their resistance to infection. In southern Byelorussia, between 
50 and 70% of children are now said to have health problems, with about 8% having 
thyroid complications in forms not observed prior to Chemobyl. The incidences of 
cancers and of congenital deformities was said to be significantly higher, while 
common illnesses were reported to have become up to 70% more frequent because 


people’s immune systems had been weakened by radiation exposure. /! 


Just how much radiation the population of Byelorussia actually received is difficult to 
determine due to a shortage of instruments and poor methodologies. ’2 Some 
researchers have estimated that one-fifth of the children had received 10 gray or more 
since the accident. This was described as 10 times as much as would be needed to 
cause illness and about 100,000 times as much as people normally encounter in a year 


from background radiation. 


Realizing they underestimated the extent of damage from the accident, Soviet officials 
have announced that 14,000 more people will be moved from the area in 1990.73 
Pravda said radioactive dust that has piled up in the exclusion zone around the plant 
will take decades to remove and will have to be processed by a special, as yet unbuilt, 


complex. 
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Soviet reports indicate that 32 districts in six regions of the Ukraine are affected by 
radiation to varying degrees, with nearly 60,000 people living in the area that is strictly 
monitored. /4 Furthermore, in the territory with radiation levels above five curies, 
there are more than 200,000 inhabitants. This area includes districts more than 54 km 
from Chernobyl. Ninety thousand people have been moved from their homes in the 
years after the accident, apparently in addition to the 100,000 who were taken out of 


the exclusion zone a few days after the accident. The Pravda report indicated that the 


events at Chernobyl contaminated 4.9 million hectares in the Ukraine, of which about 
two-thirds was agricultural land. This did not include areas of neighbouring 


Byelorussia, where an estimated 20% of that republic was contaminated. 7° 


Three regions of Byelorussia that are severely affected by fallout are to be made into a 
reserve where scientists will study the effects of radiation on wildlife. 7° According 
to Tass, some 1,000 hectares of forest, up to 7 km from the reactor, are expected to 
die. Mutations are already reported to be appearing in vegetation on the edge of the 
dying forest, with some pine trees having needles 10 times as big as normal, and oak 


and acacia trees having sprouted huge leaves. 


Surveys have recorded high counts of radioactivity on the beds of reservoirs as well as 
in fish, water insects, hedgehogs, shrews, voles and waterfowl. Some rodents have 
been reported to show genetic abnormalities.’ One scientist who has been studying 
the badly-affected Narodichi district of Zhitomir province in the Ukraine said that 
gross abnormalities are appearing in cows and pigs, and noted that "undoubtedly this 
region is greatly contaminated with strontium-90." However, these anecdotal accounts 
of severe malformations of local flora and fauna do not accord with what is known of 


the after-effects of the Hiroshima and Nagasaki explosions. 7° 


There has been some concern that, in spite of a much greater degree of candor than 
was evident in the past, the Soviet authorities have not reported honestly the number of 
deaths resulting from the accident at Chernobyl. /? In summer, 1986, the death toll 
was officially fixed at 31 where it remains. Two probable victims omitted from the 
list are: Valerii Legasov, who led the Soviet delegation to the Post-Accident Review 
Conference in Vienna in 1986, and who committed suicide two years and a day after 
the accident; and Volodymyr Shevchenko, who made a documentary film about the 


struggle to bring the reactor under control. He died a few months later. 
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One recent article described a first-hand account by a Soviet journalist of events in the 
Ukraine at the time of the accident. The author noted that while the rest of the world 
was alert, in despair, full of alarm, the population of Kiev - only 80 km from 
Chernobyl - was absolutely at ease, and unaware of the disaster. The populace did 
not learn of the accident for eight days, and thus took no steps to minimize possible 
exposure to fallout. Even the reports prepared by the Soviets for presentation to 
United Nations agencies in Vienna and elsewhere were said to have been immediately 
classified, and thus were largely unavailable to the Soviet public and even the USSR’s 


academics. 81 


In terms of social impacts, most of the houses and other structures in the 30-km 
exclusion zone will likely be demolished and trees planted.82 Some elderly farmers 
have been permitted to return to and remain in the area which is the least contaminated 
portion of the zone.83 The loss of thousands of hectares of some of the most 
productive farm land in the Soviet Union is another cost which citizens will have to 
bear. The Ukraine Republic comprises less than 3% of the USSR but produces 23% of 
its food.84 


Other local and regional impacts include the cost of constructing a new city 
(Slavotich) 60 km from Chernobyl, and costs of relocating plant workers. Chernobyl’s 
major impacts, at both the local and global levels, could well be economic and 
psychological, with plant workers, their families and the general population intensely 
85 


anxious about the dangers of radiation. 


Because of the great expense incurred, the government of the Byelorussian SSR has 
independently appealed to the international community, through the United Nations’ 
Economic and Social Council, for all possible assistance.°® Byelorussian 
representatives indicated that an area populated by 2.2 million residents had been 
contaminated by radioactive fallout and the Republic has essentially lost 20% of its 
farmland. Dozens of settlements have ceased to exist due to evacuation of residents to 
uncontaminated areas and new spots of radioactive fallout deposition are still being 
discovered. More than 100,000 people were said to still be living in the areas with 


caesium-137 contamination densities over 15 curies per square kilometre. 


The estimated expenditures required under the latest version of the Byelorussian 
Republic’s State Program for Eliminating the Consequences of the Chemobyl 
Accident are 17 billion rubles (almost two annual budgets of the BSSR) including 12.8 
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billion rubles of capital investments. A comparable figure for the Ukraine was said to 
be another 17 billion rubles.87 


Potential Impacts to the USSR 


The Chernobyl nuclear accident has had impacts throughout the USSR as well as at the 


international and global levels. 


According to Dr. Robert P. Gale, an American physician who played a major role in 
the international medical assistance which was provided to the Soviet Union following 
the accident, the most important aspect of Chernobyl to date is the role it plays in 


Soviet politics. 


Chernobyl is a rallying point for several political 
constituencies including environmentalists, persons 
concerned with the impact of technology on society, 
policy planners responsible for energy development 
within the Soviet Union, and, to a lesser extent, 

_ Ukrainian nationalists. Representatives from each of 
these constituencies have campaigned on platforms 
relating to various aspects of the Chernobyl accident 
and have recently been elected to the Soviet 
Congress of Deputies. Because these persons have 
political alliances to which they must respond, it is 
important to carefully weigh their statements 
concemins the consequences of the Chernobyl 
accident. 


The economic cost to the Soviet Union of the accident is still not fully calculated. It 
has been reported that there was a direct cost of about $6.8 billion relating to loss of 
the reactor, relocations, medical care and decontamination, along with an equal 
amount for indirect costs, such as replacement of lost power, new construction and 
food surveillance. With additional costs within other countries, the total may be about 
$15 billion.8? One Soviet parliamentarian estimated the USSR would need about 
$380 billion over the next 10 years to deal with the consequences of Chernobyl.?0 


In terms of human health, Anspaugh et al. (1988), on the basis of a large amount of 
environmental data and new integrated dose assessment and risk models, calculated 
the collective dose commitment to the approximately three billion inhabitants of the 
Northern Hemisphere to be 930,000 person-gray, with 97% in the western Soviet 
Union and Europe.?! 
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Their best estimates for the lifetime expectation of fatal radiogenic cancer would 
increase the risk from 0 to 0.02% in Europe and from 0 to 0.003% in the Northern 
Hemisphere. In other words, one might project up to about 17 thousand additional 
fatal cancers caused by radiation in Europe, where some 123 million are normally 


92 Since these estimates are derived from 


expected, an increment of about 0.01%. 
increments in a probability distribution, they are not certain, and the authors did not 
rule out zero increased cancers as a possibility. Probably, in reality, no adverse health 
effects will be identifiable by studies of the populations in the remainder of the Soviet 
Union or abroad. This would apply to cancers as well as other adverse health effects 
such as severe mental retardation or genetic disorders, where the incidences are said to 
be expected to be so low as to be unobservable, compared to natural or spontaneous 
incidence.?> Estimates of health effects as well as social and economic impacts 
based on such predictions are considered by the authors to be reasonable but early 
projections. As such, their evaluation and, where possible, validation in 
highly-exposed populations and the environment will require study for some period of 


years. 


Robert Gale has noted?* that the Byelorussian government has used a stricter 
standard than is conventionally used internationally as a basis for evacuation planning, 
So it is difficult to assess whether the extent of the evacuations is justified. Dr. Gale 
reported that an increased incidence of radiation concerns will be detectable only 
within the proximate exposed population which includes about 800,000 persons now 
residing in the Soviet Union. The current plan is to follow their health annually, 
although whether this can be done within the unstable political and economic 


framework of the present Soviet Union may be uncertain. 
Dr. Gale’s characterization of the radiation-related health impacts follows: 


In summary, there are likely to be long-term health 
consequences of the Chernobyl accident, particularly 
an increased incidence of cancer. However, it is not 
possible to accurately predict their magnitude. These 
same reservations apply to predictions of teratogenic 
affects and genetic abnormalities as a consequence of 
the accident. Unless a careful epidemiology 
study/surveillance program is performed, it may not 
be possible to detect these effects. It is also possible 
that their magnitude may be sufficiently low that 
other changes in cancer-related risk factors, such as 
SEEMS <smoking or diet, will obscure the accident’s 
Cllects: 
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Certainly, there was widespread concern in many countries regarding the potential 
effects of radioactive fallout from Chernobyl. Deposition from the radioactive plume 


8 


was measured in Germany,?© France,?/ Japan,” eastern Europe,?” and 


elsewhere. These ground deposits exceeded health guidelines for protective action in 


communities as far as 2,000 km from Chemoby].!00 


In the USSR, major regulatory changes are underway to revamp the nuclear plant 


101 including for the first 


licensing process and reorganize the entire nuclear program, 
time, public involvement. Elsewhere in the Soviet Union, local opposition to proposed 
and existing nuclear plants has increased.!92 The accident has served a role in 
unmasking institutional weaknesses in the country’s management of complex 


technologies. 
Intemational Impacts 


Increasing scepticism regarding nuclear power has been reported in Britain, Greece, 
Italy, Finland, the Netherlands, Hungary and West Germany. However, although the 
growth of public opposition to nuclear power was followed by some softening of 
opposition by 1987, some reports suggest that in no nation has opposition declined to 


its pre-Chernoby] level. 103 


For a substantial part of Europe’s agricultural community, Chernobyl was not a 
distant, abstract event but one that demanded temporary and, sometimes, long-term 
changes in lifestyle and livelihood.194 Since a potential pathway of radiation 
exposure for humans is through consumption of contaminated meats, milk and 
produce, many farmers throughout Europe were immediately and dramatically affected 
by government intervention to control contamination, as well as public caution based 


on news reports. 


105 


Lofstedt and White have recently summarized a number of such cases. Examples 
include: 
° in West Germany, dairy cattle were removed from pastures contaminated with 


iodine-isotope fallout throughout a substantial area surrounding Lake 
Konstanz. Since then, dietary adjustments by many consumers in response to 
the fallout have intensified and extended the economic jolt felt by West 
German farmers; 
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° deposition of caesium-137 in the Cumbrian Mountains of northern England 
resulted in an initial three-week ban on the movement or slaughter of four 
million sheep on 7,000 farms. The ban was soon extended indefinitely, and a 
substantial number of farms are still affected; and 


° the Saami people of northern Sweden, with about 2,500 active herdsmen 
overseeing 275,000 reindeer, depend on their herds for their own meat 
consumption and as a cash crop exported to the urban centres of southern 
Sweden. A substantial proportion of the reindeer were declared contaminated 
and unfit for human consumption. Even when the meat became "safe" again, 
public demand for reindeer was diminished greatly, placing severe economic 
and social strain on the Saami, who are now much more dependent on 
government subsidies and welfare. 


In the United Kingdom, studies are now underway to see if adding minerals to the land 
could reduce the amount of radioactive caesium taken up by vegetation, 106 Because 
of the continuing presence of radioactive hotspots on fells grazed by sheep in north 
Wales, southwest Scotland and Ulster, government restrictions remain in force on the 


movement and slaughter of animals in the most affected areas. 


Since Chernobyl, the British government has spent £4 million on research on 
caesium-137 on peaty upland soils, and £7 million to compensate farmers for lost 


income from lamb sales.107 


The economies and environments of other European nations stretching from Norway 
to France were affected by Chemoby!.198 In Switzerland fishing was banned, 
perhaps indefinitely, when caesium concentrations in fish and lake sediments became 
elevated. The reindeer economy of the Norwegian Laplanders has been undermined 
for up to seven years, while in Austria there was significant contamination of 
grasslands, requiring the purchase of other fodder. Greece was forced to suspend the 
production of sheep and goat cheese. Significant impacts on lamb, mutton and cattle 


production were experienced throughout Scandinavia. 


Only time may tell what the ultimate impact of Chernobyl has been on human health 
and the environment. The number of infant deaths in southern Germany was 
significantly higher than expected in the months following the accident, although 
further investigations will be needed to confirm or refute an association between early 
infant mortality and radioactive fallout from Chernobyl. !09 A prominent 
epidemiologist in Britain noted that "These are the first lot of tentative but disturbing 
findings" that the accident at Chernobyl adversely affected health. /10 
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Whether or not radiation from Chernobyl actually does result in direct health problems 
or environmental damage outside the Ukraine and Byelorussia, it is clear that 
significant economic impacts have occurred in many European regions, and that fear 
and stress and their effects are widespread. Cleanup and mitigation costs in the USSR 
will have an enormous iunpact on the Soviet economy. Concerns raised by the 
accident will also be an important factor in determining future nuclear energy policies 


in that country. 


Much of the discussion on nuclear accidents centres on the human costs, but the 
Chernobyl accident has shown that the direct impact on other resources, particularly 
agriculture, can also be severe.11 The aggregate effect of such an accident is 
extremely large and unpredictable. As the western European experience shows, costs 
are not insignificant even if the impact on human health is minimal. Furthermore, the 
costs incurred depend on the policies adopted and the degree of coordination and 


pre-planning involved. 


Many countries have reviewed their own nuclear industries following Chernobyl, to 
identify whether any features of that disaster might provide lessons for future 
operation of commercial power plants abroad. It can safely be said that almost no 


industrialized country was untouched by the accident at Chemobyl. 


THREE MILE ISLAND & CHERNOBYL: 
SOME COMMON FEATURES 


While these two accidents were dissimilar in many ways, particularly in their release 
of radioactivity, consideration of points in common which may have contributed to 


these incidents is instructive. 


John F. Aheame, Chairman of the U.S. Department of Energy’s Advisory Committee 
on Nuclear Facility Safety, undertook such a comparison following the accident at 
Chernobyl. Dr. Ahearne has extensive experience in the scientific and regulatory 
aspects of nuclear power, and was an invited witness for hearings of Ontario’s Select 
Committee on Energy during its review of Ontario Hydro’s Demand/Supply Planning 
Strategy in 1988412 At these hearings, Dr. Ahearne provided a comparison of 
Canada’s nuclear power industry with those in the United States and other countries, 
so that he is particularly well qualified to compare the Chernobyl and Three Mile 


Island reactor accidents. 
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Dr. Ahearne reported several similarities in these two accidents: 113 
° In both cases the accidents occurred in the early morning, about 4 a.m. at TMI 
and a little after 1 a.m. in the Ukraine. These are typically slow periods on 
shifts. 
° Both reactors are very sensitive to perturbations in the system; the positive 


void coefficient makes the RBMK extremely sensitive, while the TMI Babcock 
& Wilcox design has a once-through cooling system with a small volume of 
water compared with other U.S. reactors, and is said to be well-known in the 
U.S. nuclear industry as being more responsive to perturbations than other U.S. 
designs. 


° Complacency among operators, utilities, vendors, regulators and government 
oversight committees was evident in both countries. Neither country’s nuclear 
industry believed that a major accident was possible. 


° The Chernobyl operators did not pay attention to wamings from various 
sensors. TMI operators did not believe temperature readings that indicated 
steam was exiting through a stuck-open valve. 


° In each case, the operators took a series of steps that were deliberate and that 
defeated the safety systems. 


° The operators at Chernobyl had no simulator training for the accident sequence 
that occurred. Similarly, TMI operators had never trained for the sequence of 
the stuck-open valve, and instructions on how to handle such an event were not 
written in their emergency procedures. 


° Both the TMI and Chernobyl accident reviews found weaknesses in the 
approval of operating procedures. In neither case were plant safety committees 
standard before the accidents, and there was no such input into reviewing and 
revising operating procedures. 


° In each case, the operators did not understand their plant’s engineering or basic 
nuclear processes. In other words, the operating staff had insufficient 
familiarity with the special features of the processes in a nuclear reactor to 
maintain sufficient feeling for the hazards involved. 


It is significant to note that a number of the aspects of the accidents which Ahearne 
felt contributed to their occurrence and severity, are related to personnel factors and 
procedures, rather than to hardware deficiencies. While all reactor types have design 
features which need particular care during operation, the themes of complacency, 
failure to anticipate potential accidents and simulate them during training, and poor 
understanding of the reactors and nuclear processes by operators run prominently 
through the accounts of these major accidents. Clearly, these are management 


deficiencies rather than technical shortcomings, and of the factors noted above, 
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perhaps complacency is the most insidious and threatening to any application of 


technology, from power workshop tools to nuclear reactors. 


OTHER EXAMPLES OF NUCLEAR ACCIDENTS 
NRX Reactor - Chalk River, Ontario (1952)! 14 


An accident that occurred at the NRX reactor (an experimental model from which the 
CANDU eventually evolved) was in some ways similar to the Chernobyl accident, 
although on a very much smaller scale and without injuries. The damage was not as 
severe, and when the core had been replaced, the reactor returned to service. The 
causes were determined to be operator errors in incapacitating the shut-down rods, 
which were followed by a rise in power to which they could not react. The operators 
then manually fired another shut-down mechanism which quickly drained the 


heavy-water moderator, but this was too late to prevent damage to the reactor core. 


Lessons learned which were directed toward the design of CANDU reactors were 


described by Atomic Energy of Canada Limited to be: 


° keep the control and shutdown systems independent; 
° keep the mechanical design simple and powerful; and 
° ensure the shutdown systems can be tested on-power to meet stringent 


reliability targets. 


A serious accident also took place at the NRU research reactor at Chalk River in the 
1950s. Less serious accidents, due to failure in pressure tubes, occurred at Pickering 
(1983) and Bruce (1986). There have been no fatal casualties at Canadian reactors as a 
result of nuclear accidents, and workers exposed to high radiation doses at NRX and 


NRU show no increased cancer mortality. 115 


West Germany (1977)! 16 


An over-pressure accident at the Gundremmingen boiling-water reactor damaged 
pressure-relief safety valves and contaminated the reactor building or the containment 


chamber, causing the plant to be closed down. 
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West Gemnany (1987)! 17 


A "top-level" accident took place at a pressurized-water reactor near Biblis in 
December 1987 but there was no public disclosure until 1988. The accident released 
only small amounts of radiation but it reportedly could have been worse. The 
operators made mistakes that allowed radioactive steam at high pressure into an 
emergency cooling circuit designed to take steam at low pressure. Before the accident, 
the operators had failed for 15 hours to notice a light warning them of an open valve 
between the primary and emergency cooling systems. When they noticed the light, 
they tried to close the valve by opening another to reduce the pressure on the first 
valve. This released steam and small amounts of radioactivity. Attempts to close the 
valve eventually succeeded. There was no rupture of pipework and normal operation 


of the reactor continued. 
Windscale (Sellafield), United Kingdom (1957)! 18 


The world’s first major nuclear accident appears to have been a fire at a plutonium 
separation facility in northwest Britain. A fire developed in the graphite moderator of 
a gas-cooled reactor used to produce fuel for nuclear weapons. The plant, which was 
not a commercial power reactor for generation of electricity, was largely destroyed. 
Over 20,000 curies of iodine were released into the atmosphere, compared with 30 
curies at TMI. A detailed inquiry into the accident revealed that the fire, which burned 
for a considerable period of time before it was detected, was the result of both major 
design faults and lack of experience among technical staff. The Chairman of Britain’s 
Atomic Energy Authority at the time recently noted that the accident had "all the 
hallmarks of an industry in a hurry" but added that "one should not judge what 


happened 30 years ago in the light of what we now know." 
Sellafield, United Kingdom (1986)! 19 


The Windscale plant was subsequently redeveloped under the name of the Sellafield 
reprocessing plant, and comprises a number of facilities for storing and reprocessing 
spent fuel from nuclear reactors. Leaks of radioactive water from fuel storage sites 
became a serious problem in the 1970s when, in one case, 100,000 curies of 
radioactivity escaped into the ground over a number of years. Leaks were also 
reported in 1985-86. In February 1986, an "amber alert" took place in a 20-year-old 


chemical separation plant when, during maintenance on a pump unit used to sample 


Legislative Research Service 
oil 


plutonium nitrate, a valve failed. A mist of plutonium was released and the plant was 
shut down for 15 hours. Around 50 microcuries of radioactivity escaped into the 
atmosphere outside the plant. Of the 71 workers evacuated, two were later found to be 
slightly contaminated. It should be noted that Sellafield is not a nuclear power station, 


but a facility to reprocess spent fuel from Britain’s civil nuclear power stations. 
Kyshtym (Kasli), USSR (1957) 


An explosion took place in a high-level nuclear waste dump at a weapons production 
plant in the Ural Mountains which released a total amount of radioactivity in the same 
order of magnitude as that which resulted from the Chermobyl accident.120 While 
the accident was kept secret for 30 years, and earlier "glasnost-era" reports indicated 
2 million curies of radiation had been released and several hundred square kilometres 
contaminated,!21 later information revealed that 20 million curries were released 
into the atmosphere, and 15,000 square kilometres had been contaminated by fallout, 


primarily in the form of the long-lived radionuclide strontium-90. 


The accident involved a chemical explosion in a tank containing radioactive 
waste.!22 There were said to have been no casualties, but 600 people were removed 
from the most heavily-affected zone over the succeeding week and, over the next eight 
to 22 months, the remaining 9,500 inhabitants of the region were evacuated, as the 


radiation threat became increasingly apparent. 123 


Once again, this accident was not at a commercial nuclear power station, but rather a 


military nuclear waste disposal facility. 
National Reactor Testing Station, Idaho, USA (1961)!74 


Servicemen working on a three-megawatt boiling-water reactor are reported to have 
caused the control rods to be lifted out of the core. This made the reactor go 
supercritical and led to a melting of fuel. The debris from a resultant steam explosion 
killed three workers, although the radiation levels to which they were exposed have 


been described as fatal in any event. 
Enrico Fermi Breeder Reactor, Michigan, USA (1966)! 29 


An accident at this plant has been reported to have resulted in a partial meltdown. The 


200-megawatt reactor, 30 miles south of Detroit, was a demonstration facility backed 
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by the US Atomic Energy Commission. 
AEC Reactor, Los Angeles, USA (1959)!26 


The fuel elements in another, smaller Atomic Energy Commission reactor, located just 


outside Los Angeles, melted during an accident involving loss of coolant. 
Hanford Nuclear Reservation, Washington State, USA (1944-1966) 


Although not an "accident" in the sense that other events discussed in this section 
were, "serious exposures to radiation were experienced by the public in the vicinity of 
the Hanford facilities.127 More than 400,000 curies of radioactive isotopes were 
released secretly into the atmosphere between 1944 and 1947 during the reprocessing 
of uranium, when radioactive fuel rods were dissolved in acid to extract plutonium for 
use in nuclear weapons. As well, residents who drank water and ate fish from the 
Columbia River were exposed to radiation when eight of Hanford’s nine nuclear fuel 


production reactors discharged radioactive cooling water between 1964 and 1966. 


Initial studies to assess doses received by the public suggest that, from the airborne 
incidents alone, about 5% of the 270,000 residents living in the vicinity of the plant 
may have received "significant" doses of radiation, largely from ingesting 
contaminated dairy products. Studies are now underway to assess possible health 


impacts, particularly in terms of thyroid disease. 128 


The Hanford Nuclear Reservation has also been used as a depository for a wide range 
of nuclear wastes, including millions of gallons of highly radioactive liquid wastes 
generated from the processing of plutonium for use in nuclear weapons. 129 
Concerns have been expressed about leaks of liquid wastes, steam explosions, and the 
potential for explosions due to gases, largely hydrogen, which form in the storage 
tanks. This situation is of particular interest to Canadians since the Hanford site is 


close to the border with British Columbia.130 


Summary 


This list of incidents is not intended to be complete or comprehensive, but to give a 
sense of the types of significant accidents which have occurred in the life of the 
nuclear industry. It is noteworthy that military facilities such as Windscale and 


Kyshtym were responsible for the greatest releases of radioactivity to the environment 
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prior to Chernobyl, and that security and secrecy requirements may have affected 
responses to these accidents and dissemination of information, both to the public, and 


also to other nuclear programs which would have benefitted from _ these 


experiences. 131 


Considering the number of American nuclear facilities, including power plants, which 
are near the Canadian border, it is particularly important that federal and provincial 
emergency response planners consider the distance that fallout from the Chemobyl 
accident travelled, with subsequent impacts on agriculture and other economic and 


social factors. 


A recent review by John Ahearne, of safety standards at US military nuclear weapons 
plants run by the Department of Energy (DOE), identified numerous shortcomings 


with the defence program facilities and procedures. 132 Dr. Ahearne!33 noted that: 


The mishaps with the P-reactor showed just how far 
practices in the defense reactor program have 
diverged from those in the commercial nuclear 
industry. The accident at Three Mile Island taught 
utilities that the unexpected could occur and led to 
major improvements in operating practices and 
training, instrumentation, accident analysis, and 
maintenance. But the veil of secrecy surrounding the 
weapons program prevented these changes from 
becoming part of the DOE knowledge base. 


For example, Louis Roddis was surprised to find that 
the post-TMI emphasis on preventing hydrogen 
explosions had not led Hanford engineers to 
incorporate this phenomenon into their analyses. 
Dennis Wildinson, another member of the N-reactor 
review panel and the first president of the Institute of 
Nuclear Power Operations, a group set up to improve 
nuclear industry performance following TMI, wrote, 
"There is an apparent sense of complacency at many 
levels from the DOE staff on down through 
contractor operations personnel that ‘It can’t happen 
here’ at the N-reactor. The major lesson from TMI-2 
and Chermoby]-4 is that accidents can happen." 


This isolation was illustrated last year, when a 
well-known  nuclear-safety expert met with 
nuclear-safety staff of a DOE contractor. The expert 
wondered why he did not recognize any of the 
employees from national and international meetings. 
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The staff members told him that they did not attend 
those meetings because they could learn nothing 
from them. The employees seemed unaware that a 
gap had grown between their practices and those of 
their colleagues in the commercial nuclear industry. 


The gap means that safety analyses like those the 
Nuclear Regulatory Commission requires for 
commercial reactors have been done poorly or are out 
of date. 


Dr. Ahearne’s main conclusion was that isolation breeds complacency. While this is 
currently true of military nuclear facilities, isolation from American nuclear data has 
been cited as a contributing factor in the British Windscale accident, when competing 
national goals limited the exchange of information. Political and ideological isolation 
may have contributed to the Soviet nuclear accidents at Kyshtym and Chernobyl, 
where western experiences, including lessons learned from Three Mile Island, were 


unknown or thought to be irrelevant in a non-capitalist environment. 


In summary, it appears that the only accident in a commercial, non-military nuclear 
power station which has released significant radiation to the external environment is 
that at Chemobyl. That example, however, is extreme. In terms of dispersal of 
caesium-137, a nuclide with great biological significance, the Chernobyl release was 
135 


equal to that of a very large nuclear bomb, in the 20 megaton range. Even at 
1,500 km, fallout in some places far exceeded the levels recorded during the period of 
atmospheric nuclear weapons testing. 136 Recent news reports indicate that the 
situation in Byelorussia may be even worse than originally thought, with the republic 
seeking international aid to help move one-fifth of its 10 million people from 


contaminated land.!37 The Chernobyl accident was a very significant event. 


CANDU AND CHERNOB YL 


Basic Designs 


The CANDU and RBMK (Chemobyl) reactor designs are quite different in most 
respects. The CANDU reactor is fuelled by unenriched uranium oxide, moderated by 
heavy water and cooled by heavy water. The RBMK is fuelled with 2% enriched 


uranium oxide, moderated with graphite bricks, and cooled with ordinary "light" 
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water. The CANDU has an indirect steam cycle, while in the RBMK, steam from the 
reactor goes directly to the turbines. Table 3 lists the major design features of each 


design. 138 


It is beyond the scope of this paper to compare the two reactor designs in detail. 
Several reviews have done so.!39 Among the main practical differences are the 


following: 


° the RBMK lacked the CANDU’s massive confinement system; 


° the RBMK cooling system involved much larger volumes of water capable of 
turning into steam than does CANDU. This underlay the massive structural 
damage at Chernoby]; 


° the RBMK’s moderator was flammable graphite whose burning carried aloft a 
large part of the radioactive debris and gases at Chernobyl]; and 


: the Chernobyl reactor was unable to achieve rapid shutdown following the 
power excursions whereas early failure of the calandria in CANDU accidents 
would lead to rapid shutdown. 


Atomic Energy of Canada Limited has indicated that the severe accident at the NRX 
reactor at Chalk River in 1952, which largely resulted from an inability to shut down 


during a power rise, has led to a particular emphasis on shutdown capability in the 


design of the CANDU reactors in Canada. Contemporary designs have: 140 

. independent control and shutdown systems; 

° simple and powerful mechanical design; and 

° the capacity to test the shutdown systems on-power to meet reliability targets. 


An ubiquitous statement!41 to the effect that "Canada’s CANDU plants are North 
America’s closest operating relatives to the reactor that exploded at Chernobyl" has 
often been attributed to an article in Technology Review by William Sweet.42 In 
fact, that quote is an editorial headline and does not appear in the text of Mr. Sweet’s 
article which deals with one very important similarity between the RBMK and the 
CANDU designs: the positive void coefficient. There are two other major design 
features which are common to the two reactor types. These are the use of pressure 
tubes instead of a single large pressure vessel as in most BWR and PWR designs, and 
the related ability of the RBMK and the CANDU to be fuelled while in operation. 


This on-line fuelling capability differs from other reactor designs in that the reactor 
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does not have to be shut down for refuelling, but fuel rods can be replaced 


continuously. The following sections describe these design similarities in more detail. 


TABLE 3 


COMPARISON OF CANDU 600 AND CHERNOBYL DESIGNS 


FEATURE 
Design 
Coolant 


Steam cycle 


Fuel 


Moderator 


Fuel channels 
Safety Systems 


Containment 


Shutdown 


Emergency Core Cooling 


CHERNOBYL 


Ordinary water 

Direct (steam & water from reactor are 
separated and steam goes directly to turbines) 
~2% enriched uranium oxide 


Graphite bricks 
(max. temp. 700°C) 


Vertical, pressure-tube, no calandria tube 


No upper containment -- lower containment is 
concrete cells surrounding high pressure piping 
& connected to water pool, to reduce the 
building pressure. 


One mechanism: 

- absorber rods 

10 seconds to be effective 
Effectiveness depends on state of plant 


High pressure injection driven by gas and 
pumps, then pumped flow 


CANDU (typical) 


Heavy water 

Indirect (hot water from reactor boils 
ordinary water in a boiler to steam, which 
then goes to the turbine) 

Natural uranium oxide 


Heavy water 
(max. temp. ~88°C) 


Horizontal, pressure tube with calandria tube 


Concrete building, or multi-unit negative 
pressure containment, surrounding all major 


piping, with water spray (dousing) to reduce | 


the building pressure. 

Two complete systems: 

- absorber rods 

- liquid injection 

2 seconds to be effective 

Effectiveness independent of state of plant 


High pressure injection driven by gas or 
pumps, then pumped flow 


Source: V.G. Snell and J.Q. Howieson, Chernobyl - A Canadian Perspective 
(Mississauga: Atomic Energy of Canada Limited, December 1986), p. 16. 
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Positive Void Coefficient 


The CANDU and RBMK reactors are the only operating commercial power plants 
which have a substantial positive void coefficient of reactivity.143 This effect occurs 
when an increase of reactor void caused by coolant boiling leads to an increase in 
reactor reactivity (or power).144 In the event of a loss of coolant accident in a 
CANDU reactor, the coolant in the pressure tubes will boil, creating steam voids. This 
will rapidly accelerate the chain reaction, requiring shutdown within two seconds. 
This is the positive void reactivity which the Hare Commission described as "one of 
CANDU’s less desirable characteristics."145 


The Chernobyl accident occurred because when certain tests were initiated, the flow of 
coolant in the reactor decreased and the rate of steam production began to increase. 
Because of the positive void coefficient of reactivity, the steam production produced a 
feedback effect which caused the reactor power to increase. The control system was 
unable to cope with this power increase, and under these conditions, the emergency 
shutdown equipment could not act quickly enough to terminate it. The result was a 
rapid, uncontrolled rise in reactor power which was terminated only when there was a 


violent explosion which destroyed the reactor. 146 


Other reactor designs, such as the US water-cooled plants, have the opposite effect: 
the power goes down as the boiling increases. Atomic Energy of Canada Limited 
(AECL) pointed out that this is not necessarily safer, but that it just means that there is 
a different accident where the power goes up.147 For example, in a boiling-water 
reactor if the steam valves on the boilers close by mistake, the reactor starts behaving 
like a pressure cooker with the valve closed: the pressure rises and compresses the 
water, and since compression is the opposite effect to boiling, the power goes up. So 
BWRs must have shutdown systems to be able to handle this. AECL suggests that the 
general rule is quite simple: the shutdown systems must be powerful enough to 
overcome all sources of a power increase so as to shut the reactor down in an 
emergency. The larger the effect of boiling (whether positive or negative), the harder 


this is to do. It is better to have a small coefficient than a large one. 148 
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The Atomic Energy Control Board (AECB) is the agency of the Government of 
Canada which controls the development, application and use of atomic energy. It 
exerts its authority by means of general regulations, regulatory policy statements and 
guides, and through licenses for specific facilities. 149 Noting the very important role 
played by the positive void coefficient of reactivity in the Chernobyl accident, AECB, 
in its analysis of the safety implications for CANDU reactors, came to the following 


conclusions: 


CANDU reactors also have a positive void 
coefficient of reactivity, although the effect is 
smaller (by about a factor of 3) than in Chemobyl 
design when operating at low power levels. In the 
accident at Chemobyl, while the emergency 
shutdown system operated as designed, it was not 
designed to cope with the rapid increase in reactivity 
caused by the sudden increase in coolant void, and 
was therefore unable to act quickly enough to stop 
the increase in reactor power. If such an-event, a 
rapid power increase with no effective shutdown 
system, were to occur in a CANDU reactor, the 
positive void coefficient could exacerbate the 
reactivity increase, and it is difficult to predict 
whether the reactor would shut itself down before 
power reached a level at which violent failure would 
occur. However, if a shutdown system operated as 
designed, it would terminate the reactivity increase 
and prevent serious consequences from occurring. 


All the commercial reactors in the world have ways 
of adding significant reactivity, regardless of whether 
the void coefficient is positive or negative, and 
therefore require shutdown systems to cope with 
accidents in which reactivity increases. The design 
of all reactors and their licensing requirements must 
ensure that shutdown systems can act quickly 
enough, and add sufficient negative reactivity, to 
overcome the maximum reactivity which can be 
added in an accident .... 


... The implications of the positive void coefficient 
of reactivity in CANDU reactors cannot therefore be 
considered in isolation, but must be examined 
together with the effectiveness of CANDU shutdown 
systems in coping with accidents in which the void 
reactivity is a factor. 
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. . . The safety analyses for CANDU reactors are 
required to demonstrate the effectiveness of each 
shutdown system in shutting the reactor down 
sufficiently quickly to mitigate the consequences of a 
wide range of accidents from any power level. These 
postulated accidents include events such as rupture of 
a large pipe in the main reactor cooling system, 
partial or total loss of circulating pumps, and failure 
of the reactor control system, all of which have the 
potential to produce a rapid increase in the volume of 
steam in the reactor and a consequent positive void 
coefficient. As a result of the above, the capability of 
the shutdown systems on CANDU reactors is 
required to be considerably greater than that of the 
emergency protective system at the Chemobyl 
reactor, particularly with respect to the speed at 
which they can shut down the reactor. Whereas the 
Chernobyl system was designed to insert negative 
reactivity at a rate of about 5 mk/s, a CANDU 
shutdown system can insert at least 24 mk in less 
than two seconds and for some designs the value is 
much higher. 


Furthermore, the requirement that CANDU shutdown 
systems be fully independent from the reactor control 
systems means that their effectiveness must not 
depend on supplementary action by rods of the 
control system, as was the case at Chernobyl. 


For those reactors which have two fully effective, 
reliable, and independent shutdown systems, the 
possibility that neither shutdown system would 
successfully shut down the reactor in an emergency 
Situation is extremely remote. For this reason, the 
AECB accepts that complete failure to shut down in 
an accident does not need to be considered in the 
safety analyses of such reactors. 


On the basis of the above, it is concluded that, for 
reactors which conform to current AECB licensing 
requirements, accidents similar to the one that 
occurred at Chernobyl are adequately protected 
against. The requirements for shutdown system 
design are adequate to ensure that a fast reactor 
shutdown will occur when required, even for those 
accidents in which the positive void coefficient of 
reactivity plays an important role. 
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Nevertheless, the severity of the accident at 
Chernobyl would suggest that it would be prudent to 
re-examine the safety analyses of CANDU reactors, 
with particular attention to events in which a rapid 
increase in the volume of steam may occur, or in 
which there may be a rapid increase in reactivity, to 
confirm that the shutdown systems are indeed 
sufficiently effective. In addition, it appears 
appropriate to examine possible configurations of 
reactivity devices to ensure that it is not possible to 
put the reactor in an unusual configuration in which 
the shutdown Systems might be rendered less than 
adequately effective. 0 


The AECB came to different conclusions for the four older reactors at Pickering "A" 
whose two shutdown mechanisms are not independent of each other and rely on 
common instrumentation. In view of the severity of the consequences of the 
Chernobyl accident, AECB concluded that it would be prudent to re-examine the 
safety of these reactors, particularly with respect to accidents involving failure of the 
reactor control system or loss of coolant accompanied by unavailability of the 


shutdown system. 151 


The latter case was independently simulated by Ontario Hydro and by Argonne 
National Laboratory in the United States at the request of the Hare Commission. 152 
The results, which were very similar, indicated that a severe accident of this sort 
would damage the reactor, probably irreparably, and might cause unsafe conditions for 
the reactor operators and maintenance crews. But there would probably only be minor 
effects on the general public. The Commissioner expressed hope that the AECB 


would require such extreme-case analyses for all CANDU reactors. 


The other possible accident sequence, involving simultaneous failure of the regulating 
system and failure to shut down at Pickering A, was not analysed by the Hare 
Commission, but its review concurred with the AECB recommendation that such a 


sequence should be analysed in the same way.5 3 


The earlier AECL analysis of the Chernobyl accident concluded that no new processes 


or failure models had been revealed, and that Canadian design and operating practices 
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precluded the inadequacies of the Soviet RMBK reactors and its operators. Only the 


154 The Hare Commission 


positive void reactivity coefficient was a common factor. 
noted!95 that, as the Ontario Hydro-Argonne analyses pointed out, the CANDU 
design presumes the need for highly-efficient, fully-computerized control systems, and 
also for a fast shutdown system or systems. Pickering A is the least well protected 
CANDU station in this respect, yet in its updated form, it appeared in the 
Commission’s analyses, to be capable of containing almost all the released fission 


products except, as usual in such cases, the least damaging: the inert noble gases. 


William Sweet, in his comparison of the CANDU and RBMK reactor designs,!9® 
cited Ontario Hydro vice president William Morrison as saying "Every reactor 
[design] has the potential for large reactivity increases, but only the RBMK did not 
recognize this adequately." In the same critique, Zig Damaretski, safety chief at 
AECB was reported to comment that the RBMK’s shutdown system is satisfactory 
only when the reactor is at full power, but accident analyses seem to have assumed full 


power: an "almost incredible attitude." 
On-line Fuelling 


Like the RBMK, the CANDU is fuelled while operating in contrast to pressure vessel 
reactors in which the reactor must be shut down during the entire refuelling operation, 
thereby not producing electricity for an extended period. Unlike the RBMK, however, 
the CANDU is fuelled horizontally, so the rods do not penetrate the top, and the 


fuelling mechanism is encased in a formidable containment structure. 157 


At Chernobyl, the initial explosion brought down the heavy on-line refuelling gantry 
on top of the reactor, damaging the pipes of the emergency core-cooling system. This 
would not be the case if a similar event occurred in a CANDU reactor, because the 
fuelling mechanisms operate from the front and back of the reactor, so that they are not 


suspended above it. 158 


There may be safety advantages in dispersing the fuel among separated rods. Webb, in 
a comparison of western (non-CANDU) reactors with the RBMK made the following 


observations: 


The fuel rods in PWRs and BWRs are all bound 
together in a compact, large bundled mass of fuel 
rods (40,000 rods) inside a single vessel; whereas in 


Legislative Research Service 
42 


the RBMK the fuel rods are separated in groups of 18 
rods that are dispersed in a large block of graphite, 
which has very good heat conduction and dissipation 
properties. The bunching of fuel rods in the PWRs 
and BWRs thus concentrates the fuel to maximize the 
heat-up temperatures of a fuel melt-down, and 
consequently to maximize the potential for fuel 
boiling and vaporizing and releasing the fission 
products and plutonium. The fuel bunching also 
maximizes the potentials for a coherent interaction 
and mixing of a large mass of molten fuel and water, 
to produce the maximum potential steam explosion, 
which is about 200,000 pounds TNT equivalent for 
the PWR and BWR. Also, the single large vessel 
provides a source of ready water for such a steam 
explosion, which cannot be drained out in an 
emergency, aS was the pam quench pond beneath 
the Chernobyl reactor. 5 


Because refuelling is possible without shutdown, the RBMK-1000 has recorded 
capacity factors of 80% or higher, which, with the CANDU, are among the highest in 
the industry.169 (The term ‘capacity factor’ refers to the energy actually produced in 
a given year divided by the energy that would have been produced had the reactor 


operated at full power at all times). 
Pressure Tubes 


A final common major feature between the RBMK and the CANDU designs is the use 
of pressure tubes to contain the fuel. Most commercial power reactors use a single 
thick stainless steel pressure vessel to contain the entire core. CANDUs and RBMKs, 
however, contain the nuclear reaction within hundreds of fuel channels or pressure 
tubes. All contain fissioning fuel while the reactor is on stream, and all are connected 
to, and are hence part of, the primary heat transport system, which pumps hot, 
high-pressure water through the inner part of the channel to remove heat to the steam 


generators or turbines. 161 


One prominent nuclear engineer!©2 


pointed out that the use of many pressure tubes, 
rather than a single large pressure vessel as in PWR and BWR designs, may be a 
safety advantage. Should a catastrophic explosive rupture occur in a large pressure 


vessel, this would represent a single failure event for which there is no protection. 


The PWR and BWR containment are not designed to 
withstand a reactor vessel rupture. The 100-ton 
vessel closure dome could be blown 500 metres 
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upwards by a vessel rupture, easily destroying the 
containment. Furthermore, such a dome blow-off 
could conceivably carry away the reactor’s nuclear 
control rods, causing a severe runaway of the atomic 
reactions in the reactor core (due to the control rods 
being rapidly pulled out of the core), in addition to 
the tendency of the exploding reactor coolant to blow 
the core through the containment -- all of which are 
possibilities which have not yet even been 
investigated. The Chernobyl RBMK-type reactor 
uses no reactor pressure vessel pnd thereby avoids 
such catastrophic potentialities. b 


The use of pressure tube technology is not, however, without challenges. Following 
the accident at Chernobyl, one of the design modifications introduced to render the 
RBMkKs less vulnerable to the type of accident thought to have destroyed Unit 4 was to 
make the control rod system faster. 164 According to one commentator, the speedier 


fuel rods could cause other serious problems related to the pressure tubes: 


Each RBMK pressure tube has a sensitive weld 
toward the top and bottom, which joins an inner 
zirconium-alloy section to outer steel sections. The 
Soviets were well aware that these welds were 
vulnerable to sudden temperature changes, according 
to Herbert Kouts, of Brookhaven National 
Laboratory, who believes one reason the RBMK had 
a slow control system was to avoid subjecting the 
welds to excessive thermal shock. 


If control rods were inserted suddenly, causing the 
temperature of the reactor to change abruptly, there is 
a serious danger that several of the tubes would 
rupture. A dozen or so breaks would easily suffice to 
lift the lid of the reactor, break the tubes and control 
mechanisms, and precipitate the chain of events that 
occurred the night of April 26. 


In fact, Richard Wilson of Harvard and some other 
experts believe that a multiple tube rupture might 
have actually caused the Chernobyl accident. In this 
scenario, the accident may have resulted when the 
operators subjected the reactor to thermal shocks as 
they sought to stabilize it at a low power level. 
Whether or not this actually happened, it could have 
happened. Wilson says that he and others have tried 
to get the Soviets to focus on this scenario. but the 
Westerners have had little apparent success. 
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The Ontario Nuclear Safety Review examined pressure tube problems with Ontario 
Hydro’s CANDU stations and noted that "the pressure tube technology has many 
advantages, but only if integrity of the tubes can be guaranteed through long working 
periods." 166 The review Commission describes the pressure tube problems as the 
"most serious" to have affected Ontario Hydro’s power reactors.1©7 The following is 


a summary of these pressure tube problems as presented by the Hare Commission: 


Leaks of heavy water from these tubes (into the fuel 
channel’s annulus) have been detected 23 times since 
1971, indicating that they were not performing as 
expected. These leaks were easily detected, so that 
defective tubes could be replaced. But on 
1 August 1983, a pressure tube ruptured suddenly at 
Pickering A. Contaminated heavy water escaped into 
the reactor building. It was subsequently found that 
many tubes in units 1 and 2 were in poor condition. 
Between 1983 and 1988, the reactors were refitted 
with tubes made of a different alloy. Meanwhile, 
1,030 MW of power were immobilized and had to be 
replaced. The work was performed well under 
awkward and hazardous conditions. Total costs will 
exceed $425 million, and collective radiation 
exposure to workers was over 7 Sv (well below prior 
estimates, but still high). 


A further pressure tube rupture occurred on 26 March 
1986 at the Bruce A NGS, when the reactor was shut 
down. The surrounding calandria tube also ruptured. 
The consequences were less damaging than at 
Pickering A, but the event emphasized _ the 
seriousness of the problem. 


The cause of these failures is known to be formation 
within the zirconium, or at stressed points within and 
on its surface, of enclosures or blisters of zirconium 
deuteride (usually called hydride). This weakens the 
tube. Moreover, the extent of deformation of the 
tube due to the neutron bombardment, and to 
unplanned displacement of the garter springs 
separating it from the calandria tube, has been larger 
than predicted. A major research program is under 
way to find solutions. 


The Review’s technical consultants agreed with 
Ontario Hydro and AECL that such pressure tube 
failures have serious economic consequences, but 
present little threat of radiative exposure of the public. 


If, however, there are major pressure tube failures in 
the future, there will certainly be a threat to the 
operational and maintenance crews in the reactor 
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building, as well as a large refitting cost. And I am 
not convinced that there is no danger of public 
exposure, especially if the failure spreads to other 
fuel channels. Accordingly, maximum priority 
should be given to finding a solution, and to 
improved monitoring of the fuel channels, to avoid 
further surprises. | 


A detailed consideration of the pressure tube problem in CANDU reactors is provided 
in the Hare Commission’s Technical Report. 169 Of the two major recommendations 


made by the Commission, one related to pressure tubes: 170 


Major Recommendation 2 - Integrity of Pressure 
Tubes 


That maximum and effective priority be given to 
finding a solution to the pressure tube problem, and 
to improved in-reactor monitoring. Investment in 
fuel channel research by Ontario Hydro should be 
increased, and greater emphasis given to the 
fundamental metallurgical problems, tapping expert 
knowledge available in other industries. 


HUMAN FACTORS 


In comparing the Chernobyl accident with Ontario’s nuclear reactors, the Hare 
Commission remarked that at Chernobyl, "operational incompetence and neglect of 
regulations reached astonishing heights. Ontario Hydro’s responsible and well-trained 


shift supervisors and operators would be unlikely to behave so ineptly."171 


In earlier sections of this report which examined Three Mile Island, Chernobyl and 
other civilian and military nuclear accidents, the recurring human themes were 
isolation and complacency, both among plant operators and senior management. John 


Ahearne’s comparison of TMI and Chernobyl! 72 


noted a lack of understanding of the 
basic physics of the reactors on the part of operating staffs and the failure of 
simulation training to anticipate the accidents which occurred. As well, senior 


management in both cases did not believe a serious accident could occur. 


The Ontario Nuclear Safety Review considered many of these human factors in the 
operating systems of Ontario’s nuclear reactors. Dr. Hare’s comments are summarized 


below: 
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Ontario Hydro’s reactors are designed and built by 
Ontario Hydro’s own engineers and contracting staff, 
with input at the design stage from AECL. The 
process requires continuous interaction with AECB, 
which issues construction approvals and operating 
licences. AECB resident engineers are present at the 
station to provide continuing audit of the operating 
system. 


The reactors are each under the direction of a Station 
Manager, who reports to the Nuclear Generation 
Division (NGD) at Ontario Hydro headquarters. The 
Station Manager is also directly responsible to AECB 
for all safety and licensing questions. In safety and 
radiological questions, the Station Manager is 
supported by specialized station staff and by various 
corporate groups at headquarters. The operating staff 
is organized by the Canadian Union of Public 
Employees, Local 1000, from the rank of Unit First 
Operator down. Union-management relationships in 
safety matters appear fairly satisfactory, but are not 
ideal: the 1985 dispute at Bruce came close to a 
confrontation (involving AECB) over the use of 
management personnel in operating positions. There 
are also complaints that worker safety suggestions 
are often disregarded. 


Reviews of the operating system were carried out by 
an Operational Safety Review Team (OSART) from 
the International Atomic Energy Agency and by a 
consulting team drawn primarily from the oil and 
chemical industries. These reviews found the 
operating system sound, but isolated certain areas in 
which improvement was needed: 


(i) There was a maintenance backlog at 
Pickering and  Bruce_ because of 
inadequate staffing and resources (both 
reviews). 


(ii) Conventional safety performance in 
NGD appeared inferior to that of the 
chemical industry. There had been no 
fatalities in 125 million person-hours, 
but NGD’s temporary disability rate 
(although below its own target) was 
higher than the consultants considered 
acceptable (consultants). 


(ii1) Further developments in _ refresher 
training of operating staff were advised, 
as was periodic reauthorization by 
AECB (consultants). 


(iv) Certain refinements in_ radiological 
protection were recommended (OSART). 
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(v) There were some failures in 
communication between unionized staff 
and management (consultants). 


Ontario Hydro’s response has been prompt and 
effective -- but has not yet met all the requirements. 


The system of basic training and qualification of 
reactor staff is excellent. Authorization of AECB is 
required for all positions with significant safety 
responsibility. Also excellent is the radiological 
training received and the principle that the individual 
staff member is responsible for his/her personal 
protection and has specified responsibility for the 
safety of others. 


Safety depends more on the quality and qualifications 
of the staff than on any other single factor. The 
CANDU stations are extensively 
computer-controlled, partly because of their 
complexity, and partly because of the need for instant 
response in the case of large LOCA. The operator’s 
role is to audit this automated process. The obvious 
danger is boredom and inattention. Much depends on 
alertness to upset conditions (which are immediately 
announced in the control rooms) and on the skill with 
which the operators respond. So far, the record at 
Ontario Hydro’s stations is good. Equally vital is the 
corporate safety imperative that lies behind it -- that 
senior management give safety its unstinted 
attention. 


In terms of training, licensing, and efforts at anticipating potential hazards, most of the 
lessons of Three Mile Island and Chemobyl appear not to have been lost on Ontario 
Hydro, the Atomic Energy Control Board, and Atomic Energy of Canada Limited. 
There does not appear to be isolation at the operation or management levels, and any 
complacency which exists is not overt. 


174 provided a rare, objective 


A recent non-technical, popular article by David Lees 
examination of nuclear power in Ontario which was reviled by pro- and anti-nuclear 
groups alike. Through interviews with operating staff at CANDU reactors as well as 
officials with Ontario Hydro, regulatory agencies and unions, he provided an 


interesting view of life working at a nuclear generating station. 


Lees presents the first operator’s job as being one of extreme high pressure and 
over-work due to a shortage of qualified personnel at that level. Indeed, his sources 
described the position as a "pressure cooker" to which many second operators do not 


aspire, !79 since it is high in stress and low on satisfaction. One first operator quoted 
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by Lees pointed out the presence of alienation between the station supervisor and his 
superiors (who are all engineers) and the operating staff.17© The senior professional 
engineering staff are portrayed as technocrats rather than managers, with few skills in 


dealing with people. 


Perhaps the most serious points noted by Lees in his article relate to an expressed 
strong feeling of apathy below the supervisory level of staff, 77 and a shortage of 


operating staff at nuclear stations, resulting in unnecessary safety oversights and 


delays in required maintenance. 178 


It is beyond the scope of this paper to assess the extent of such human factors at 
CANDU nuclear stations, but certainly there seems to be no cause for complacency. 
The Hare Commission noted several points relating to the management of Ontario’s 
nuclear power plants, which, while not individually threatening safety, nevertheless 
suggest that an overhaul of operational safety culture would be in Ontario Hydro’s and 


the public’s interest: 


(1) The conventional safety record of the 
Nuclear Generation Division (NGD) of 
Ontario Hydro is good. Its record of no 
fatalities in 125 million person-years is 
outstanding. But the rate of temporary 
total disabilities and the target rate are 
higher than in the heavy chemical 
industry. The NGD bases its practices 
too exclusively on internal assessments 
of what can be achieved. 


(il) Relations between Ontario Hydro and 
the Canadian Union of Public Employees 
Local 1000 have occasionally been 
soured by disputes. 


(ili) Control of technical maintenance at the 
stations seems fragmented, and backlogs 
appear too long. 


(iv) There are complaints that 
upward-directed safety recommendations 
are not always acted upon. 


(v) Self-audit practised among operational 
staff is not adequate; abnormal events or 
actions, with no consequences are often 
not recorded. 
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(v1) There appear to be _— undesirable 
differences in safety systems and 
radiological performance between 
stations. 
(vil) The organizational structure of the 


nuclear program appears excessively 
complex, with some ambiguities as 
regards responsibilities. 


(villi) There is confusion in settling the status 
of temporary operating instructions at 
the stations.!79 


These factors led the Hare Commission to make another major recommendation: 


Major Recommendation 1 - The Human Element 
That Ontario Hydro: 


(i) ensure that, at an early date, its operational 
organization be thoroughly re-examined, in 
close cooperation with independent 
consultants who have international 
management experience; 


(ii) commission a study of factors affecting 
human performance throughout the utility, 
for the purpose of achieving optimum 
efficiency and the maintenance of high 
standards of safe operation; 


(iii) examine and revise its arrangements for 
establishing and maintaining an_ overall 
quality assurance program for each of its 
plants after taking adage from independent 
specialist consultants. | 


Many of these initiatives are now underway. A director in the Nuclear Generating 
Division at Ontario Hydro has been reported as agreeing that, at a working level, the 
utility has been overmanaged and understaffed, but that changes are being made in 


response to reports from the Hare Commission and other studies of Hydro facilities 


based on a methodology developed by the Institute of Nuclear Power Operations.181 


"We’ve been playing catch-up for some time,” he 
says. "The problem in the nuclear business is that 
you are appraised not only on what you do but on 
what you can demonstrate that you’ve done. The 
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trick is that you have to get the right balance between 
documenting that you are doing all the right things 
without tying up so many people that they’re not 
doing their normal jobs as well as they should." 


Clearly, first operators are in short supply and fulfill a demanding role at nuclear 
generating stations. Additional safety audits recommended by the Hare Commission 
and others would require particular attention by senior operational staff, so that, 
without additional manpower being provided, the present, reportedly stressful, 


conditions are unlikely to diminish. 


A general conclusion of the Ontario Nuclear Safety Review was that actual 
performance of individuals and institutions is the key to future safety. There must be a 


sound safety culture and it must be directed from the top down. 182 


The major conclusion of the Hare Commission related to the overall safety of CANDU 
183 


nuclear stations in Ontario: 


The Ontario Hydro reactors are being operated safely 
and at high standards of technical performance. No 
significant adverse unpact has been detected in either 
the work-force or the public. 


The risk of accidents serious enough to affect the 
public adversely can never be zero, but is very 
remote. 


Ontario Hydro completed preparation of its initial response to the findings and 
recommendations of the Hare Commission in August of 1988, but the Ontario Ministry 
of Energy had not authorized Hydro to release its response or comment on its 
conclusions at the time this paper was being prepared. 184 The Ministry of Energy 
reportedly intended to coordinate reactions to the Hare report from Ontario Hydro, 
provincial ministries and the Atomic Energy Control Board, but to date these findings 
have not been made public. Hydro indicates that is has taken and continues to take 
action on issues raised by the Hare Commission, and that it has appointed an advisory 
committee on nuclear safety to keep the organization up-to-date on safety-related 
matters. This committee, recently appointed by the President of Ontario Hydro, 
includes Dr. Ken Hare and other former colleagues from the Ontario Nuclear Safety 


Review among its membership. 


Legislative Research Service 


51 


The success of Ontario Hydro and other operators of CANDU systems in maintaining 
and enhancing the high standard of human performance will be a key factor in 
ensuring the risk of severe nuclear accidents remains "remote." As one reviewer 
concluded, "the prevention of catastrophic accidents at nuclear power plants depends 
essentially on the careful, correct fabrication, construction, operation, and maintenance 
of the reactors, and not on any inherent limitations of reactor eruptions or inherent 
containment capacities of the reactor containment structures to absorb eruptions and 


contain the radioactivity, should a mishap occur." 185 
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Glossary of Technical Temms, 
Acronyms and Scientific Units 


Source: Ontario Nuclear Safety Review. 
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GLOSSARY 
1. Technical Terms 


Accident Analysis: quantitative analysis performed to simulate the consequences of 
postulated nuclear reactor accidents. 


Adjustor Rod: a rod of neutron-absorbing material inserted into or removed from the 
reactor to "adjust" reactor power or reactivity. 


Background Radiation: the natural ionizing radiation of the environment, including 
cosmic rays from outer space, naturally radioactive elements in the ground, and 
naturally radioactive elements in a person’s body. 


Baseload: the supply of electricity needed to meet the minimum demand for 
electricity during a period of time. 


Becquerel: a unit of radioactivity equal to one disintegration per second. It is a 
measure of the rate at which a radioactive material decays. Abbreviated Bq. See also 
curie. 


Boiling Water Reactor (BWR): a nuclear power reactor cooled and moderated by 
light water. The water is allowed to boil in the core to generate steam, which passes 
directly to the turbine. 


Calandria_ (vessel): a cylindrical reactor vessel, which contains the heavy water 
moderator. It is penetrated from end to end by hundreds of calandria tubes which 
provide sites for the pressure tubes. 


Calandria Tube: a tube, welded to the calandria vessel, surrounding the pressure tube 
in each fuel channel. 


CANDU: a Canadian-developed nuclear power reactor system, which uses a 
pressure tube reactor, heavy-water moderator, and natural uranium fuel. The 
moderator is separate from the reactor coolant and is maintained cool and at low 
pressure. The pressure tubes, centrally located within each calandria tube, contain 
the fuel and the high pressure coolant as it passes through the reactor. 


Chain Reaction: a reaction that initiates its own repetition. In a nuclear fission a 
neutron induces a fissile nucleus to fission, thus releasing several neutrons. To 
sustain the reaction, at least one of these neutrons must induce another fission. 


Collective Dose: the sum of the doses received by a group of exposed individuals. 


Commissioning: those activities performed subsequent to installation but prior to 
plant operation that are intended to show that equipment and systems meet their 
design requirements. 


Common-mode Event: an event that can simultaneously affect several plant systems 
at one or more reactors at a time. A loss of electrical power and an earthquake are 
examples of such events. 


Containment: the reinforced concrete structure(s) that houses the reactor and its 
closely-related systems. It is designed to suppress and contain the results of a 
fracture of the reactor coolant piping. 
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Core: the central region of a reactor where the nuclear chain reaction takes place, and 
heat is thereby generated. 


Critical: an assembly of nuclear materials is critical if it is just capable of supporting 
a nuclear chain reaction. 


Curie: a measure of the rate at which a radioactive material disintegrates. A curie is 
the radioactivity of one gram of radium and is named after Pierre and Marie Curie, 
the discoverers of the radioactive elements radium, radon and polonium. One curie 
corresponds to 3.7 x 10°” disintegrations per second. Historical unit, replaced by the 
“becquerel." 


Decommission: a process of permanently closing down a nuclear generating station, 
including the disassembly of the station components and the removal of spent fuel. 


Delayed Hydride Cracking: the fracture of hydride concentrations, especially on the 
outside surface of pressure tubes. 


Design-basis Accident: a type of reactor accident considered in setting design 
requirements for plant equipment and systems. 


Dose: a measure of biological damage caused by exposure to ionizing radiation 
(measured in sieverts or rems). Note: formally, the term "dose" is now used to 
describe the amount of ionizing radiation energy absorbed per unit mass (measured in 
grays or reds). What the Hare Commission referred to as dose is now called "dose 
equivalent." 


Dual Failure: the malfunction of a process system occurs simultaneously with the 
malfunction of a safety system. 


Effective Dose Equivalent: the summation of doses to individual organs using 
weighting factors recommended by ICRP. 


Effective Dose Equivalent: the prescribed limit for effective dose (equivalent). 


Emergency Coolant Injection System: a special safety system designed to inject cool 
water into the heat transport system following a pipe rupture. 


Enriched Fuel: nuclear fuel containing more than the natural abundance of fissile 
atoms. 


Exclusion Boundary: an area (nominally of 1-km radius) around a nuclear generating 
station under control of the reactor owner. 


Failure: a change in the characteristics of a component or system such that it is 
unable to carry out its function. 


Fast Breeder Reactor (FBR): a reactor in which fast neutrons sustain the fission 
chain reaction. The fuel is enriched, and a blanket of fertile material surrounding the 
core captures neutrons to become fissule. 


Fissile Material: nuclear fuels in which the nuclei, when hit by neutrons, fission and 
release energy plus two or more neutrons, which can result in a chain reaction. 
Uranium-233, uranium-235 and plutonium-239 are examples of significant fissile 
materials, but only uranium-235 occurs naturally in relatively large quantities. 
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Fission: the splitting of a heavy nucleus into two parts accompanied by the release of 
energy and two or more neutrons. It may occur spontaneously or be induced by 
capture of bombarding particles, particularly neutrons. 


Fuel Bundle: an assembly of fuel elements (fuel sheaths containing nuclear fuel 
pellets) and end plates, ready for insertion into a reactor. 


Fuel Channel: the set of components, consisting of the pressure tube, calandria tube, 
and end fittings, in which the reactor fuel is located. 


Fuel Element: small unit of fuel contained within the fuel bundle. 


Fuelling Machine: equipment used to load and unload fuel bundles. CANDU 
fuelling machines are remotely controlled and load the fuel while the reactor is 
operating. 


Fuel Sheath: tubing into which fuel pellets are inserted and sealed to create a fuel 
element. 


Gas-Cooled Reactor: a nuclear reactor in which a gas, such as carbon dioxide, is 
used as the coolant. 


Gray: the SI unit for dose of 1tonizing radiation. One gray is absorbed when one joule 
of energy is imparted to each kilogram of matter by ionizing radiation. One gray 
equals 100 reds. Abbreviated Gy. 


Half-Life: the time in which the number of nuclei of a particular type is reduced by 
radioactive decay to one-half. 


Heat Exchanger: a piece of apparatus that transfers heat from one medium to 
another. A typical example is the steam generator in the CANDU system, where the 
hot pressurized water coolant is used to convert ordinary water into steam to drive the 
turbine. 


Heavy Water: water in which the hydrogen atoms consist of deuterium, the heavy 
stable isotope that is present to the extent of 150 parts per million in ordinary 
hydrogen; used as moderator and coolant in CANDU nuclear reactors. 


High-Level Wastes: the irradiated fuel is the most important high-level waste. Also 
included are other items such as recovered fission products and certain ion exchange 
resins. 


Hydride Blister: a high concentration of deuterium, especially on the outside of a 
pressure tube. 


Irradiated Fuel: fuel that has been exposed to irradiation in a nuclear reactor. If 
irradiated to its maximum economic life, it is also termed "spent fuel." 


Isotopes: nuclei of the same chemical element that differ in mass. 


Kilowatt-Hour: a quantity unit of energy, e.g., electrical power delivered at a 
sustained rate of one kilowatt for a period of one hour. 
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Light Water: ordinary water. 


Loop: a closed circuit of heat transport system piping. 


Loss _of Regulation Accident: a reactor accident in which the power control 
(regulating) system malfunctions, resulting in a change in reactor power. 


Loss of Coolant Accident: a nuclear reactor accident in which the coolant drains out 
from the heat transport system. 


Low-Level Waste: this is a general term to describe the reactor wastes that arise in 
the day-to-day operation of the station. It includes such items as water purification 
filters, certain ion-exchange resins, wiping cloths, protective clothing, etc. 
Regardless of its general category, each type of waste product is dealt with according 
to the problem it presents. 


Megawatt (MW): one million watts (or one thousand kilowatts). A unit used to 
indicate the power rating of very large energy-producing (or using) equipment, e.g., 
generating stations, nuclear reactors, boilers, engines, etc. 


Melt-Down: a nuclear reactor accident in which some or all of the reactor fuel melts 
and cannot be contained within the heat transport system. 


Moderator: a substance used to slow down neutrons emitted during nuclear fission 
(heavy water in the case of the CANDU system). 


been altered (0.7% by weight of uranium-235). 


Negative Reactivity: see reactivity. 


Nuclear Energy: the energy liberated by a nuclear reaction such as fission. 


Nucleus: the positively charged core of an atom. All nuclei are made up of protons 
and neutrons, except for ordinary hydrogen, which has no neutrons. The nucleus 
contains almost the whole of the mass of the atom, but occupies only a minute part of 
its volume. 


Planning Zone: a zone surrounding a nuclear generating station for which a response 
to a nuclear reactor accident has been planned. 


Plutonium (Pu): a heavy radioactive metallic element with an atomic number of 94 
whose principal isotope plutonium-239 is a major fissile material. It is produced 
artificially in reactors through neutron absorption by uranium-238. 


Positive Void Reactivity Coefficient: an effect where an increase of reactor void 
caused by coolant boiling leads to an increase in reactor reactivity (or power). 


Power Excursion: an unplanned reactor power increase. 
Pressure Tube: the components of the heat transport system in the reactor core inside 


of which the fuel bundles reside. Pressurized heavy-water coolant flows through the 
pressure tube to remove the heat generated by the fuel. See also pressure tube reactor. 


45739 
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Pressure Tube Reactor: a nuclear reactor in which the fuel is located inside a large 
number of high-strength tubes that penetrate the calandria (which also contains the 
moderator at low pressure). Pressurized coolant passes through the tubes to remove 
the heat from the fuel. See also CANDU. 


Pressurized Water Reactor (PWR): a power reactor cooled and moderated by light 
water in a pressure vessel surrounding the core. The water is pressurized to prevent 
boiling and is circulated in a closed primary loop through a heat exchanger that 
generates steam in a secondary loop connected to the turbine. 


Primary Zone: the zone surrounding a nuclear generating station for which there 
exists an evacuation plan. 


Probabilistic Risk Assessment: a method of calculating both the frequency and 
consequences of reactor accidents. 


Rad: the unit dose of ionizing radiation. One rad is absorbed when 100 ergs of 
energy are imparted to each gram of matter by ionizing radiation (see rem). 
Historical unit, replaced by "gray." 


Radiation: the emission and propagation of energy through space or matter in the 
form of electromagnetic waves and fast-moving particles. 


Radioactivity: the spontaneous decay of an unstable atomic nucleus into one or more 
different elements or isotopes. It involves the emission of particles or spontaneous 
fission until a stable state is reached. Note that radioactivity produces the radiation - 
the two terms are not equivalent. 


Radionuclide: a general term used to describe radioactive nuclei. 


Reactivity: a measure of the departure of a reactor from criticality. A positive value 
means that the release of neutrons is increasing and that the power will rise, and a 
negative value means that the release of neutrons is decreasing, the power is falling, 
and the chain reaction could die out. 


Reactor Core: mechanically, the structural elements in the reactor that locate and 
contain the nuclear fuel. In the nuclear physics sense, it includes additionally the fuel 
and the moderator associated with each fuel cell (fuel channel). See also reactor. 


Regulating System: reactor power control system. 


Rem: the abbreviation for Roentgen Equivalent Man, the unit of an absorbed dose of 
ionizing radiation in biological matter. It is the absorbed dose in rads multiplied by a 
factor that takes into account the biological effectiveness of the radiation. Historical 
unit, replaced by "sievert". 


Retubing: replacement of the pressure tubes of a nuclear reactor. 


Risk: an activity with the potential for causing harm. In probabilistic risk 
assessment, risk is defined as the product of the frequency of a harmful event and the 
harm caused. Acceptable risk refers to an activity that has been willingly accepted by 
those bearing the risk once the benefits of that activity and the alternatives to that 
activity are considered. Tolerable risk refers to activity undertaken with the 
acquiescence of the risk bearers, but not necessarily with their conscious acceptance. 
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Roentgen: the unit of exposure to gamma or X-rays. Named after Wilhelm Konrad 
Roentgen, the discoverer of X-rays in Munich in 1895. 


Safety Culture: a set of attitudes among designers, managers, and operating staff at a 
nuclear generating station that encourages practices that foster the safe operation of 
the station. 


Safety Design Matrix: a method of probabilistic risk assessment employed by AECL 
for a limited range of postulated nuclear reactor accidents. 


Safety Support Systems: essential process systems that are required for the proper 
operation of safety systems. Electrical power is an example. 


Secondary Zone: the emergency planning zone outside the primary zone where 
measures such as sheltering, restriction of foods, and similar measures short of 
evacuation are planned should a nuclear reactor accident occur. 


Serious Process Failure: any failure of equipment or procedure that, in the absence of 
special safety system(s) action, could lead to significant release of radioactive 
material from the nuclear generating station. 


Severe Accident: 1. An accident leading to a large release of radioactive material 
from a nuclear generating station. 2. An accident that leads to a destruction of the 
core structure integrity. 


Shielding: a mass of material that reduces radiation intensity to protect personnel, 
equipment, or nuclear experiments from radiation injury, damage or interference. 


Shut-Down: termination of the chain reaction in the reactor. 


Shut-Down Systems: the special safety systems capable of terminating the chain 
reaction in the reactor rapidly. 


Shut-Off Rod: a neutron-absorbing rod normally kept out of the reactor core that can 
be rapidly inserted into the core. The entire set of these rods comprises shut-down 
system 1. 


Sievert: the SI unit of absorbed dose equivalent of ionizing radiation in biological 
matter. It is the absorbed dose in grays multiplied by a modifying factor that takes 
into account the biological effectiveness of the radiation. Abbreviated Sv. 


Significant Event Report: report documenting an unusual event at one of Ontario 
Hydro’s nuclear generating stations. 


Special Safety Systems: systems designed to limit or mitigate the consequences of 
plant process failures and thereby limit the releases of radioactivity to the 
environment and the public within acceptable limits. These systems are the 
shut-down systems, emergency coolant injection system, and containment system. 


Spent Fuel: nuclear fuel that has been irradiated in a reactor to the extent that it is no 
longer economical as a power producer, i.e., during irradiation fissionable isotopes 
are consumed and fission product poisons are accumulated. Term is used 
interchangeably with "irradiated fuel," 
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Statutory Dose Limit: the maximum dose allowed by AECB regulations. 


coolant flows through the tubes transferring heat through walls of the tubes to boil the 
feedwater and produce steam to drive the turbine generator. 


Tritium: a radioactive isotope of hydrogen with a mass number of three. It has one 
proton and two neutrons in its nucleus. It is formed in nuclear reactors; also in nature 
by cosmic radiation. 


Turbine Generator: the machine that converts the mechanical energy of the steam 
created in the steam generator to generate electrical power. 


Uranium (U): a heavy, slightly radioactive metallic element with an atomic number 
of 92. As found in nature it is a mixture of the isotopes uranium-235 (0.7%) and 
uranium-238 (99.3%). The artificially produced uranium-233 and the naturally 
occurring uranium-235 are fissile. Uranium-238 is fertile. 

Void: vapour or gas, particularly when mixed with liquid in a pipe or enclosed space. 


Void (reactivity) Coefficient: coefficient representing the relationship between the 


fraction of void present in the reactor reactivity. 

Zirconium: a naturally occurring metallic element with an atomic number of 40. The 
material is used extensively in the construction of m-core reactor components 
because it has a very high corrosion resistance to high-temperature water and low 
neutron absorption. 

2. Acronyms and Abbreviations 

AECB Atomic Energy Control Board (Canada) 

AECL Atomic Energy of Canada Limited 


ALARA as low as reasonably achievable 


BEIR (Advisory Committee on the) Biological Effects of Ionizing Radiation 
BWR boiling water reactor 

CANDU Canada Deuterium Uranium (reactor) 

Ci curie 

IAEA International Atomic Energy Agency 

ICRP International Commission on Radiological Protection (international 


society of radiologists, members from 59 countries, budget of 
$150,000.00. p/a, funding from governments and other national 
sources, about 2 full-time staff) 
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LOCA loss of coolant accident 
LWR light-water reactor 


MAGNOX = magnesium oxide reactor 


NGD Nuclear Generation Division (Ontario Hydro) 

NGS nuclear generating station 

NRU National Research Universal reactor (Chalk River Nuclear 
Laboratories, AECL) 

NRX National Research Experimental reactor 

PWR pressurized water reactor 

QA quality assurance 

QC quality control 

TMI Three Mile Island Nuclear Generating Station of the General Public 


Utilities System, USA 


TABLE OF RADIOLOGICAL QUANTITIES AND UNITS 


Conversion 


Quantity Unit Symbol saat units 

activity (1) becquerel Bq 1 Bq = 2.7x10"' curie 
absorbed dose (2) gray Gy 1 Gy = 100 rad 

dose equivalent (3) Sievert Sv 1 Sv = 100 rem 


Notes: (1) Activity is the rate of transformation (also known as rate of decay) of 
a radionuclide. 1 Bq is 1 transformation (or decay) per second. 


(2) Absorbed dose is the amount of energy imparted to unit mass of 
matter (such as tissue) by ionizing radiation. One gray equals one 
joule per kilogram. 


(3) Dose equivalent is the quantity obtained by multiplying the absorbed 
dose by a factor to allow for the different effectiveness of various 
ionizing radiations in causing harm to tissue. 
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